WeGIA: SQL injection in Material & Patrimônio module
Summary
WeGIA, a web manager for charitable institutions, contains an SQL injection in the Material & Patrimônio module. A second extract($_REQUEST) call overwrites an input value that was previously sanitized with intval(), so the raw value reaches SQL UPDATE statements. An authenticated user with access to this module can execute arbitrary SQL, which allows reading sensitive database records or modifying inventory and institutional data.
Affected
- WeGIA versions below 3.8.6
- File: web/html/matPat/restaurar_produto_desocultar.php
Fixed in
- Upgrade to WeGIA 3.8.6 or later (the research notes indicate a newer release, 3.8.7, exists for other CVEs; use the latest version)
Workaround
Unknown. No vendor-published workaround was found. If an upgrade is delayed:
- Restrict access to the Material & Patrimônio module to trusted staff
- Review database account privileges
Exploitation
- No confirmed in-the-wild exploitation or public proof of concept found
- CISA SSVC lists exploitation as "poc" and automatable as "no"
- EPSS score is low (0.00569)
Our recommendation
- Upgrade WeGIA to the latest release as soon as possible
- Check whether WeGIA is reachable from the internet and restrict access where possible
- Review staff and volunteer accounts, remove shared or weak credentials and enforce least privilege
- Review database accounts and back up data before and after the upgrade
- Monitor logs for unusual database queries in the Material & Patrimônio module
- Note that CVE-2026-55680 and CVE-2026-55684 are unauthenticated SQL injections fixed in 3.8.6, which makes the upgrade more urgent
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9q8x-jqpj-23xp github.com
- WeGIA release 3.8.6 github.com
- Fix commit 8fa3dfc github.com
- WeGIA issue #99 github.com
- OSV entry CVE-2026-55681 osv.dev
- VulDB entry 420361 vuldb.com
- OpenCVE CVE-2026-55681 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:37.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
NVD references (6)
- https://github.com/LabRedesCefetRJ/WeGIA/commit/8fa3dfcd71c2058c3b6127fdb40d3f1ec068be3e
- https://github.com/LabRedesCefetRJ/WeGIA/issues/99
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9q8x-jqpj-23xp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.