WeGIA Web Manager SQL Injection Vulnerability

WeGIA, a web manager for charitable institutions, is affected by a SQL injection vulnerability prior to version 3.8.6.

The unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements.

• Remote attackers can execute arbitrary SQL to read or modify WeGIA database content, including billing records and credential data.
• The same SQL access can delete or truncate tables, causing loss of application data.
• This issue is fixed in version 3.8.6.