CVE-2026-55683: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in LabRedesCefetRJ WeGIA

The vulnerability exists in the WeGIA product by LabRedesCefetRJ, specifically in the unauthenticated endpoint web/html/socio/sistema/cadastro_cobranca.php prior to version 3.8.6. The endpoint uses extract($_REQUEST) to accept POST parameters (valor, valor_pago, id_pessoa, id_socio, id_sociotipo) and directly inserts them into SQL UPDATE, INSERT, and SELECT statements without prepared statements or proper sanitization. This improper neutralization of special elements in SQL commands (CWE-89) enables remote attackers to execute arbitrary SQL queries, which can lead to unauthorized data disclosure, data modification, or deletion of database tables. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity. The issue is resolved in version 3.8.6.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands on the WeGIA database. This can result in full compromise of database confidentiality, integrity, and availability, including reading sensitive data such as billing records and credentials, modifying data, or deleting/truncating tables causing data loss.

Upgrade WeGIA to version 3.8.6 or later, where this SQL injection vulnerability is fixed. No other mitigation is required as the official fix addresses the issue.