Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T20:17:50.783Z",
  "pubdate": "2026-10-14T20:17:50.783Z",
  "executiveSummary": "WeGIA versions prior to 3.8.6 contain a critical SQL injection vulnerability within the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint.\nThe vulnerability arises from improper handling of user-supplied POST data, allowing unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.\nThis flaw grants attackers unauthorized access to sensitive charitable institution data, including billing information, member records, employee details, system permissions, and administrative credentials.\nSuccessful exploitation facilitates data exfiltration, unauthorized modification of financial records, and potential destruction of database tables, leading to a complete compromise of system integrity and confidentiality.\nThere are no authentication requirements to trigger this vulnerability, as the endpoint is accessible to unauthenticated users via the web interface.\nThis represents a high-risk security flaw that necessitates immediate patching to the latest version.",
  "technicalDetails": "The root cause of this vulnerability is the use of the PHP extract($_REQUEST) function on unvalidated, user-controllable POST data, followed by the unsafe interpolation of this data into a raw SQL INSERT statement.\nBy utilizing the extract() function, the application automatically registers request parameters as variables in the local symbol table, effectively overwriting existing variables. Attackers can leverage this behavior to inject arbitrary data directly into variables such as codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio.\nThe vulnerable code constructs a raw SQL query string by concatenating these variables without employing parameterized queries or prepared statements. While numeric parameters lack proper validation or quoting, the string-based parameters are enclosed in single quotes; however, an attacker can easily bypass this context by injecting a single quote character (') to break out of the intended string literal. This allows for the injection of arbitrary SQL syntax, such as UNION-based queries, error-based exploitation, or stacked queries depending on the database configuration.\nThe attack flow involves sending a crafted POST request to web/html/socio/sistema/cadastro_cobrancas_geracao.php containing malicious SQL payloads within the expected parameters. For instance, an attacker could terminate the INSERT statement and append a secondary malicious query, such as an UPDATE or DROP TABLE command, or perform exfiltration using UNION SELECT statements to retrieve sensitive rows from other tables in the database.\nBecause the application performs no input sanitization or validation, the database engine executes the injected SQL commands with the privileges assigned to the web application’s database user. This results in the complete exposure of the backend data store. Post-exploitation, an attacker can conduct unauthorized CRUD operations, escalate privileges, or effectively cause a denial of service by dropping critical database tables.\nThis vulnerability is restricted to WeGIA versions prior to 3.8.6. It is highly accessible via the network as it resides on a publicly reachable web endpoint and requires zero authentication, making it an attractive target for automated exploitation."
}