CVE-2026-55683: WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobranca.php endpoint accepts POST input through extract($REQUEST) and directly incorporates valor, valorpago, idpessoa, idsocio, and idsociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which deployments are exposed?
WeGIA deployments running versions prior to 3.8.6 are exposed if the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint is reachable by a remote attacker.
Does exploitation require an account or user interaction?
No. The affected endpoint is unauthenticated, and the issue can be exploited remotely without privileges or user interaction.
What could an attacker do through this flaw?
An attacker can execute arbitrary SQL through affected POST parameters, allowing them to read or modify database content such as billing records and credential data. They may also delete or truncate tables, resulting in application-data loss.
Which inputs are implicated?
The vulnerable request parameters are valor, valor_pago, id_pessoa, id_socio, and id_sociotipo. They are incorporated directly into UPDATE, INSERT, and SELECT statements.
What is the available remediation?
Upgrade WeGIA to version 3.8.6, which fixes this issue.