WeGIA EUVD-2026-101625

No special conditions - remote unauthenticated exploitation against default configurations of WeGIA prior to 3.8.6. The web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint is reachable without authentication and processes attacker-controlled POST data (both form-encoded and JSON) through extract($_REQUEST). Injection succeeds via string parameters (descricao, status, link_cobranca, link_boleto, linha_digitavel, and the date fields) that escape their single-quoted context, and via unquoted/unvalidated numeric parameters (codigo, id_socio, valor, valor_pago). The only limiting factor is network reachability of the WeGIA instance; upgrading to 3.8.6 fully remediates it. No user interaction, no authentication, and no non-default setting are required.

All available signals point to genuine high priority. The provided CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is internally consistent with the description: the vulnerable endpoint (web/html/socio/sistema/cadastro_cobrancas_geracao.php) is explicitly described as unauthenticated, reachable over the network, with no user interaction, and the source-code diff confirms the root cause - extract($_REQUEST) feeding unparameterized values into a raw INSERT, replaced in the fix with filter_var validation and mysqli prepared statements with bind_param. This is a textbook CWE-89 SQL injection with no mitigating authentication or complexity barrier. No EPSS score, no CISA KEV listing, and no explicit POC flag were supplied in the input, so exploitation probability and in-the-wild activity cannot be quantified from the data; the absence of these signals should not be read as low risk given the trivial exploitability. The one tempering factor is deployment footprint rather than technical severity: WeGIA is niche software for charitable institutions, so this is more likely to be opportunistically or targetedly exploited than mass-scanned. Net: a real, must-patch issue for any org running WeGIA, with the caveat that exploitation-likelihood signals (EPSS/KEV/POC) are missing from the provided data and should be checked against current threat intel.

A remote, unauthenticated attacker sends a crafted form-encoded or JSON POST request to the cadastro_cobrancas_geracao.php endpoint, placing SQL metacharacters in a string parameter such as descricao or status (which break out of the single-quoted context) or in an unquoted numeric parameter such as codigo or id_socio. Because input flows through extract($_REQUEST) directly into a concatenated INSERT statement, the injected SQL executes against the database, letting the attacker read or modify billing, member, employee, permission, and credential records or DROP tables. No public exploit was identified in the provided data, but the source-code diff publicly documents the exact vulnerable parameters and sink, making a working exploit trivial to construct.