WeGIA 3.8.6 Patch Fixes Critical Unauthenticated SQL Injection Flaw

LabRedesCefetRJ has released version 3.8.6 of the WeGIA web management system to fix a critical security vulnerability. The update addresses CVE-2026-55680, a severe flaw that permits unauthenticated attackers to execute arbitrary SQL commands against the application’s database without needing valid login credentials.

The National Vulnerability Database rates this issue as Critical with a CVSS score of 9.8. The vulnerability exists in the cadastro_cobranca.php script, which handles billing data entry. Attackers can send malicious POST requests to this endpoint, injecting SQL expressions through the codigo parameter. This allows for direct manipulation of the underlying database structure and content.

Technical Details of the Vulnerability

The root cause lies in how the application processes user input. The script uses the extract($_REQUEST) function to import variables directly into the local symbol table. This mechanism passes the codigo parameter value into an UPDATE statement’s WHERE clause without any validation or parameter binding. Because the input is not sanitized, attackers can inject quoted SQL expressions that bypass MariaDB’s type conversion for VARCHAR columns.

As described in the NVD record, this lack of validation enables arbitrary SQL execution. An attacker can read or modify sensitive database content, including user credential hashes and billing records stored in the cobrancas table. The flaw affects all versions of WeGIA prior to 3.8.6, leaving any unpatched installation vulnerable to remote exploitation by anyone with network access.

This incident mirrors broader trends in content management systems where improper input handling leads to severe breaches. As Threat Times reported on 2026-10-14, e107 CMS version 2.3.7 also fixed a critical unauthenticated SQL injection in its Alt Auth plugin, highlighting the persistent risk of similar coding errors in web applications.

Affected Systems and Scope

The vulnerability impacts WeGIA, a web manager designed specifically for charitable institutions. Organizations using this software to manage donations, billing, and member data are at risk. Since the attack does not require authentication, any publicly accessible instance of WeGIA running a version older than 3.8.6 is exposed.

The ability to access the cobrancas table is particularly dangerous for non-profit entities. Billing records often contain sensitive financial information and donor details. Compromise of this data could lead to significant privacy violations and financial fraud. The critical severity rating reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability.

What should you do?

Administrators running WeGIA should immediately verify their current version. If the system is below version 3.8.6, they must apply the latest update to patch the SQL injection vulnerability. Delaying the update leaves the database open to unauthenticated attacks that can exfiltrate or alter critical organizational data.