CVE-2026-40285
SQL Injection in WeGIA Allows Authenticated User Identity Spoofing
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wegia | wegia | to 3.6.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-302 | The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker. |
| CWE-473 | A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise. |
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WeGIA, a web manager for charitable institutions, in versions prior to 3.6.10. It is a SQL injection flaw located in the file dao/memorando/UsuarioDAO.php. The issue arises because the cpf_usuario POST parameter is used in a way that overwrites the session-stored user identity through the use of extract($_REQUEST) in the function DespachoControle::verificarDespacho(). The attacker-controlled value is then directly inserted into a raw SQL query without proper sanitization, allowing any authenticated user to query the database as if they were an arbitrary user.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an authenticated user to impersonate any other user by manipulating the cpf_usuario parameter. This can lead to unauthorized access to sensitive data, modification of data, and potentially full compromise of the database. The CVSS score of 8.8 indicates a high severity with impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade WeGIA to version 3.6.10 or later, as this version fixes the SQL injection issue.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an authenticated user to perform SQL injection attacks that enable querying the database under an arbitrary identity. Such unauthorized access to sensitive data can lead to breaches of confidentiality, integrity, and availability.
As a result, organizations using affected versions of WeGIA may face compliance issues with standards and regulations like GDPR and HIPAA, which require strict controls over personal data access and protection against unauthorized disclosure.