CVE-2026-40285 is a SQL injection vulnerability in the WeGIA web manager for charitable institutions, specifically in dao/memorando/UsuarioDAO.php. The vulnerability occurs because the cpf_usuario POST parameter is extracted from the request and overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(). The attacker-controlled value is then directly interpolated into a raw SQL query without proper sanitization or parameterization. This flaw allows any authenticated user to execute SQL queries under an arbitrary user identity, potentially compromising confidentiality, integrity, and availability of the database. The vulnerability affects all versions prior to 3.6.10, which contains the fix.

Successful exploitation allows an authenticated user to perform SQL injection attacks, enabling them to query the database as any user identity. This can lead to unauthorized data disclosure, modification, or deletion, impacting confidentiality, integrity, and availability of the system. The CVSS 3.1 base score is 8.8, indicating a high severity vulnerability with network attack vector, low attack complexity, requiring privileges but no user interaction, and full impact on confidentiality, integrity, and availability.

Upgrade WeGIA to version 3.6.10 or later, where this SQL injection vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade availability and instructions from the vendor LabRedesCefetRJ. Until upgraded, restrict access to authenticated users and monitor for suspicious activity related to the cpf_usuario parameter. Patch status is not explicitly confirmed in the advisory, but version 3.6.10 is stated to fix the issue.