WeGIA: Unauthenticated SQL injection in billing form via codigo parameter
Summary
WeGIA, a web manager for charitable institutions, contains an unauthenticated SQL injection in cadastro_cobranca.php. The codigo parameter is inserted into an UPDATE statement without validation or parameter binding, and a quoted value bypasses type conversion. An attacker can send crafted POST requests without logging in to read or modify database content, including user credential hashes and billing records.
Affected
- WeGIA versions before 3.8.6 (per CNA data; one aggregator lists up to 3.8.5)
Fixed in
- Fixed in WeGIA 3.8.6
Workaround
- Unknown. No vendor workaround was verified.
- Restrict access to the WeGIA host by IP allowlist or VPN until patched (own recommendation, not vendor guidance).
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- Not listed in CISA KEV. EPSS very low (about 0.5%).
- No public proof of concept or reports of exploitation found; this does not prove absence.
Our recommendation
- Identify all WeGIA instances, including test and partner installations.
- Upgrade to WeGIA 3.8.6 or later.
- If patching is not possible immediately, remove direct internet exposure of the application.
- Review web server logs for POST requests to cadastro_cobranca.php and check the cobrancas table and user credential tables for unexpected changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-fxcc-q2j6-w2rf github.com
- WeGIA release 3.8.6 github.com
- Fix commit f819be3 github.com
- WeGIA issue #184 github.com
- WeGIA pull request #1705 github.com
- VulDB entry 420350 vuldb.com
- OpenCVE CVE-2026-55680 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:54.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
NVD references (5)
- https://github.com/LabRedesCefetRJ/WeGIA/commit/f819be361f984592c4b5a35db830495b4e2263fa
- https://github.com/LabRedesCefetRJ/WeGIA/issues/184
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-fxcc-q2j6-w2rf
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.