CVE-2026-55680
Deferred Deferred - Pending Action

SQL Injection in WeGIA Prior to 3.8.6

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-55680
EUVD
EUVD-2026-101620

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LabRedesCefetRJ WeGIA < 3.8.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated SQL injection vulnerability in WeGIA versions before 3.8.6. Attackers can send a POST request with a specially crafted 'codigo' parameter containing a quoted SQL expression. The application uses extract($_REQUEST) which passes this input into an UPDATE statement's WHERE clause without validation or parameter binding. This bypasses type conversion and allows arbitrary SQL execution without a session.

Detection Guidance

Check if your WeGIA instance is running a version prior to 3.8.6. Inspect web/html/socio/sistema/cadastro_cobranca.php for use of extract($_REQUEST) and raw mysqli_query() calls without prepared statements. Test with a payload like codigo=' OR SLEEP(10)-- to observe delays in responses.

Use network scanning tools to detect unauthenticated POST requests to /web/html/socio/sistema/cadastro_cobranca.php with crafted SQLi payloads in the codigo parameter.

Impact Analysis

An attacker could read or modify database content, including sensitive data like user credential hashes and billing records in the cobrancas table. They could also execute administrative operations or take full control of the application's database.

Compliance Impact

This vulnerability could lead to unauthorized access and exposure of personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable versions would fail compliance audits.

Mitigation Strategies

Upgrade WeGIA to version 3.8.6 or later immediately. If upgrading is not possible, remove or restrict access to cadastro_cobranca.php until patched. Implement WAF rules to block SQLi patterns in the codigo parameter.

Review database permissions to limit exposure. Ensure no sensitive tables like pessoa are accessible without authentication. Monitor logs for suspicious POST requests to the vulnerable endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart