WeGIA SQL Injection Vulnerability in Billing Endpoint

WeGIA, a web manager for charitable institutions, is affected by a SQL injection vulnerability in versions prior to 3.8.6.

The unauthenticated endpoint web/html/socio/sistema/cadastro_cobrancas_geracao.php accepts form-encoded POST data through extract($_REQUEST) and interpolates multiple parameters into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context.

• Affected versions: prior to 3.8.6
• Precondition: unauthenticated access to the endpoint
• Impact: arbitrary SQL execution to read or modify billing, member, employee, permission, and credential data, or delete database tables
• Fixed in: 3.8.6