CVE-2026-55684: WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract($REQUEST) and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor, valorpago, status, linkcobranca, linkboleto, linhadigitavel, and idsocio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.6
Event History
Frequently Asked Questions
Which deployments are exposed?
WeGIA deployments running versions prior to 3.8.6 are affected if the unauthenticated cadastro_cobrancas_geracao.php endpoint is reachable. The vulnerable endpoint is under web/html/socio/sistema/.
Does an attacker need an account or user interaction?
No. The endpoint is unauthenticated, and exploitation can be performed remotely by sending form-encoded POST data; no privileges or user interaction are required.
What data or operations could be impacted?
An attacker can execute arbitrary SQL, enabling reads or modifications of billing, member, employee, permission, and credential data. They may also be able to delete database tables.
What is the remediation?
Upgrade WeGIA to version 3.8.6, which fixes this issue.