WeGIA EUVD-2026-101620

No special conditions - remote unauthenticated exploitation against default installations of WeGIA prior to 3.8.6, reachable via a single POST to web/html/socio/sistema/cadastro_cobranca.php. The specific trigger is supplying a quoted/string value in the codigo parameter, which defeats MariaDB's implicit numeric type conversion on the VARCHAR column and lets the value break out of the unbound WHERE codigo= clause of the UPDATE. The only meaningful limiting factor is reachability: the vulnerable endpoint must be network-accessible to the attacker; no authentication, user interaction, or non-default configuration is required.

All available technical signals align on high real-world severity. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) is consistent with the description: a single unauthenticated POST to cadastro_cobranca.php reaches an UPDATE statement where the codigo parameter is interpolated without binding, giving remote, low-complexity, no-interaction SQL injection (CWE-89) against the cobrancas table with High confidentiality, integrity, and availability impact. The source-code diff independently CONFIRMS the root cause and fix - extract($_REQUEST) with an unparameterized WHERE codigo=$codigo query is replaced by FILTER_VALIDATE_INT on codigo plus a mysqli_prepare/bind_param prepared statement - so this is a genuine, verifiable flaw rather than a high-CVSS-but-low-real-risk label. Countervailing signals temper urgency: EPSS is NOT provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. The dominant risk-limiting factor is deployment footprint - WeGIA is niche software - not any technical barrier, since exploitation itself is trivial once an instance is reachable.

An attacker who can reach an internet-exposed WeGIA instance older than 3.8.6 sends an unauthenticated POST to web/html/socio/sistema/cadastro_cobranca.php with a quoted SQL payload in the codigo parameter; the quoting defeats MariaDB's numeric type conversion on the VARCHAR column and injects arbitrary SQL into the UPDATE's WHERE clause. With no session required, the attacker reads or modifies database content, including user credential hashes and billing records. No public exploit code is referenced, but the attack requires only a crafted HTTP request.