CVE-2026-55684 Details

A SQL injection vulnerability has been identified in WeGIA, a web management tool for charitable organizations, in versions prior to 3.8.6. The issue resides in the 'html/socio/sistema/cadastro_cobrancas_geracao.php' endpoint, which processes form-encoded POST data. The vulnerability arises because the endpoint directly incorporates user input into a SQL INSERT statement without proper validation or sanitization. Numeric inputs are unquoted and unchecked, while string inputs can escape their single-quoted context, allowing for arbitrary SQL execution. This exploitation could lead to unauthorized access or modification of various data, including billing, member, employee, permission, and credential information, as well as the ability to delete database tables.

The vulnerability has been patched in WeGIA version 3.8.6. Users should update to this version. The patch involves replacing the vulnerable SQL injection point with a secure implementation using PDO prepared statements, ensuring proper validation and sanitization of all input parameters.