WeGIA SQL Injection Vulnerability

WeGIA, a web manager for charitable institutions, is affected by a SQL injection vulnerability prior to version 3.8.6.

Unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter. The extract($_REQUEST) call passes this value into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding.

• Quoting the value bypasses MariaDB type conversion for the VARCHAR column.
• Arbitrary SQL execution is possible without a session.
• An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table.
• Fixed in version 3.8.6.