Unauthenticated POST requests to cadastro_cobranca.php allow an attacker to insert a quoted SQL expression into the "codigo" parameter, which is then injected directly into a WHERE clause of an UPDATE statement. Because the value is not validated or parameterized, the attacker can bypass MariaDB type conversion for the VARCHAR column and execute arbitrary SQL. This flaw enables reading or modifying critical database records, including user credential hashes and billing data in the cobrancas table.

The vulnerability applies to WeGIA web managers deployed by LabRedesCefetRJ, specifically versions prior to 3.8.6. Any installation that has not yet upgraded to the 3.8.6 release remains exposed.

The CVSS score of 9.8 classifies this flaw as critical. EPSS data is not available, and it is not listed in the CISA KEV catalog. Attackers can exploit the issue by sending unauthenticated HTTP POST requests to the affected script, so any adversary with network or web access to the application can trigger the injection without needing valid credentials.