WeGIA CVE-2026-55681

Exploitation requires a valid authenticated WeGIA account whose role grants access to the Material & Patrimônio (Material & Patrimony) module, and the attacker must reach the specific endpoint web/html/matPat/restaurar_produto_desocultar.php with a controlled id_produto parameter. The limiting factors are the authentication requirement (PR:L) and the module-level authorization - this cannot be triggered by an anonymous visitor. No user interaction, non-default configuration, or special platform is needed beyond running a WeGIA instance prior to 3.8.6; the flawed extract($_REQUEST) is present in the default code path.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description and the source diff: a network-reachable PHP endpoint where a second extract($_REQUEST) clobbers the intval()-sanitized id_produto, interpolating attacker-controlled input into three UPDATE statements - a textbook CWE-89. The PR:L is well-justified because the description explicitly requires an authenticated user with access to the Material & Patrimônio module, so this is not an unauthenticated internet-wide risk. No EPSS score, no CISA KEV listing, and no SSVC decision data were supplied, so exploitation-probability and automatability signals are simply absent rather than low; their absence should not be read as 'safe.' There is no public exploit identified at time of analysis - the only code artifact is the vendor's fix commit, which is a patch, not a weaponized POC. Net assessment: a genuine high-impact SQL injection that is real and worth patching for any WeGIA operator, but the required authenticated foothold plus the niche, low-footprint nature of the product mean it is far below the priority of a comparably-scored flaw in ubiquitous software. Treat as a standard high-priority patch for WeGIA deployments, not an emergency for the broader fleet.

An authenticated low-privilege WeGIA user who can reach the Material & Patrimônio module sends a crafted id_produto value in a request to web/html/matPat/restaurar_produto_desocultar.php; because extract($_REQUEST) overwrites the intval()-cleaned variable, the raw value is injected into the UPDATE statements. The attacker leverages this to read sensitive records or tamper with institutional and inventory data. No public exploit code is identified, but the vendor fix commit publicly reveals the exact vulnerable sink.