Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T20:17:50.193Z",
  "pubdate": "2026-10-14T20:17:50.193Z",
  "executiveSummary": "WeGIA versions prior to 3.8.6 contain a critical SQL injection vulnerability in the 'cadastro_cobranca.php' script.\nThe vulnerability arises from improper handling of user-supplied input via the 'codigo' parameter, which is processed using the 'extract($_REQUEST)' function without sanitization or parameter binding.\nThis allows unauthenticated remote attackers to execute arbitrary SQL commands directly against the backend MariaDB database.\nSuccessful exploitation results in full database compromise, enabling unauthorized actors to read, modify, or delete sensitive information, including user credential hashes and financial billing records.\nThe flaw stems from the application's failure to validate inputs before incorporating them into an SQL 'UPDATE' statement, bypassing standard type conversion protections.\nGiven the lack of authentication requirements, this vulnerability represents a high-risk exposure for charitable institutions utilizing affected versions of the software.",
  "technicalDetails": "The vulnerability is located in the file 'web/html/socio/sistema/cadastro_cobranca.php' within the WeGIA application. The root cause is the reliance on the 'extract($_REQUEST)' function, which dynamically registers request variables into the current symbol table without sufficient validation or sanitation.\nThe application specifically fails to parameterize user input passed through the 'codigo' parameter before it is integrated into a database 'UPDATE' query. In the vulnerable implementation, the 'codigo' value is inserted into a 'WHERE' clause, such as 'WHERE codigo=...'. By injecting a quoted SQL expression, an attacker can prematurely terminate the intended string literal and append malicious SQL syntax.\nBecause the input is not sanitized, an attacker can manipulate the query structure to bypass the application's intended logic. By injecting arbitrary SQL commands, the attacker can force the database to execute unauthorized operations. The use of quotes effectively circumvents MariaDB's type conversion mechanisms for the underlying VARCHAR column, facilitating the injection of complex payloads.\nThe attack flow proceeds as follows: First, the attacker identifies the target endpoint at 'web/html/socio/sistema/cadastro_cobranca.php'. Second, the attacker crafts a malicious HTTP POST request containing a crafted 'codigo' parameter, such as a SQL injection payload designed to manipulate the 'cobrancas' table or extract data from other system tables. Third, the PHP interpreter processes the request using 'extract($_REQUEST)', importing the malicious input into the script's scope. Fourth, the application passes this contaminated variable directly into the database query engine. Finally, the database executes the injected commands with the privileges of the application's database user.\nThis vulnerability is particularly severe because it is accessible to unauthenticated users, requiring no prior session or special privileges. Post-exploitation impact includes full unauthorized access to database contents, potentially leading to the exfiltration of sensitive administrative credentials or the tampering of financial records, which directly compromises the integrity and confidentiality of the charitable institution's data."
}