{"id":"CVE-2026-55684","published":"2026-10-14T20:17:50.783","lastModified":"2026-10-15T16:18:17.000","description":"WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/38cb19baeee90b334817fb9b40f967996c9ee36b","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/183","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/pull/1705","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g2hm-m6gw-fcgg","tags":[]}],"exploitRefs":[{"url":"https://github.com/LabRedesCefetRJ/WeGIA/commit/38cb19baeee90b334817fb9b40f967996c9ee36b","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/issues/183","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/pull/1705","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6","tags":[]},{"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g2hm-m6gw-fcgg","tags":[]}],"hasPoc":true,"ai":{"summary":"A SQL injection vulnerability in WeGIA's billing generation endpoint allows unauthenticated attackers to execute arbitrary SQL commands against the database, potentially leading to full data compromise including member, employee, and credential information.","exploitability":"The vulnerability is highly exploitable with no authentication required, as the endpoint uses extract($_REQUEST) which directly imports all POST parameters into variables, making it trivial for an attacker to inject malicious SQL through any of the interpolated fields.","blast_radius":"The impact could be severe across the entire charitable institution's database, affecting billing records, member information, employee credentials, and potentially allowing attackers to delete critical database tables or escalate privileges.","remediation":"Upgrade to version 3.8.6 immediately to fix this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T08:52:59.433Z"}}