WeGIA: Unauthenticated SQL injection in billing generation endpoint
Summary
WeGIA, a web manager for charitable institutions, contains an SQL injection flaw in the billing endpoint cadastro_cobrancas_geracao.php. Request parameters are passed through extract($_REQUEST) and concatenated into a raw INSERT statement without proper escaping. An unauthenticated remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission and credential data, or to delete database tables.
Affected
- LabRedesCefetRJ WeGIA versions before 3.8.6
- Endpoint: web/html/socio/sistema/cadastro_cobrancas_geracao.php
Fixed in
- Fixed in WeGIA 3.8.6
Workaround
- No vendor-published workaround known.
- Until the upgrade, restrict access to the affected path at the reverse proxy or WAF.
- Limit the database account's privileges.
Exploitation
- No confirmed exploitation in the wild known.
- No public proof-of-concept exploit linked to this CVE found.
- CISA SSVC: Automatable yes, technical impact total.
- The endpoint path is easy to locate with search engines.
Our recommendation
- Identify all WeGIA instances and their versions, including internet-exposed ones.
- Upgrade to WeGIA 3.8.6 or later.
- Until then, restrict access to the affected paths and review database logs for unexpected INSERT or error patterns.
- Verify recent backups exist.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-g2hm-m6gw-fcgg github.com
- WeGIA Release 3.8.6 github.com
- Fix commit 38cb19b github.com
- Pull request #1705 github.com
- Issue #183 github.com
- VulDB entry 420363 vuldb.com
- OpenCVE CVE-2026-55684 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:55.
Original description (NVD)
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
NVD references (5)
- https://github.com/LabRedesCefetRJ/WeGIA/commit/38cb19baeee90b334817fb9b40f967996c9ee36b
- https://github.com/LabRedesCefetRJ/WeGIA/issues/183
- https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
- https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.6
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g2hm-m6gw-fcgg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.