CVE-2026-40285
Received Received - Intake
SQL Injection in WeGIA Allows Authenticated User Identity Spoofing

Publication date: 2026-04-17

Last updated on: 2026-04-20

Assigner: GitHub, Inc.

Description
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-17
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-40285
EUVD
EUVD-2026-23529
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wegia wegia to 3.6.10 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-302 The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
CWE-473 A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in WeGIA, a web manager for charitable institutions, in versions prior to 3.6.10. It is a SQL injection flaw located in the file dao/memorando/UsuarioDAO.php. The issue arises because the cpf_usuario POST parameter is used in a way that overwrites the session-stored user identity through the use of extract($_REQUEST) in the function DespachoControle::verificarDespacho(). The attacker-controlled value is then directly inserted into a raw SQL query without proper sanitization, allowing any authenticated user to query the database as if they were an arbitrary user.

Impact Analysis

This vulnerability can have severe impacts because it allows an authenticated user to impersonate any other user by manipulating the cpf_usuario parameter. This can lead to unauthorized access to sensitive data, modification of data, and potentially full compromise of the database. The CVSS score of 8.8 indicates a high severity with impacts on confidentiality, integrity, and availability.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade WeGIA to version 3.6.10 or later, as this version fixes the SQL injection issue.

Compliance Impact

This vulnerability allows an authenticated user to perform SQL injection attacks that enable querying the database under an arbitrary identity. Such unauthorized access to sensitive data can lead to breaches of confidentiality, integrity, and availability.

As a result, organizations using affected versions of WeGIA may face compliance issues with standards and regulations like GDPR and HIPAA, which require strict controls over personal data access and protection against unauthorized disclosure.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-40285. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart