{"id":"CVE-2026-55680","published":"2026-10-14T20:17:50.193","lastModified":"2026-10-15T16:18:16.273","description":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/184","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/pull/1705","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf","tags":[]}],"exploitRefs":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/184","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/pull/1705","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection vulnerability in WeGIA allows unauthenticated attackers to execute arbitrary SQL commands against the database by manipulating the 'codigo' parameter in a specific endpoint. This flaw enables attackers to read and modify sensitive data including user credentials and billing records without needing any authentication.","exploitability":"The exploit is straightforward to execute with no prerequisites, requiring only an HTTP POST request to the vulnerable endpoint with a specially crafted 'codigo' parameter value that bypasses MariaDB's type conversion for VARCHAR columns.","blast_radius":"The vulnerability affects charitable institution management systems that use WeGIA versions prior to 3.8.6, potentially exposing sensitive user data and financial records across multiple organizations using this software.","remediation":"Upgrade to version 3.8.6 or later immediately to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:52:48.521Z"}}