The affected endpoint allows an unauthenticated web user to send a POST request that is processed with PHP's extract($_REQUEST) without any input validation or prepared statements. The request parameters valor, valor_pago, id_pessoa, id_socio, and id_sociotipo are inserted directly into UPDATE, INSERT, and SELECT statements. This flaw permits an attacker to inject arbitrary SQL commands that can read, modify, delete, or truncate database tables, exposing billing records, credential data, and other sensitive information. The vulnerability can also cause data loss by dropping tables or deleting data, posing a serious confidentiality, integrity, and availability risk. A patch in WeGIA version 3.8.6 eliminates the vulnerable code path.

The vulnerability affects the WeGIA web manager developed by LabRedesCefetRJ. All deployments running a WeGIA version earlier than 3.8.6 are susceptible. No specific sub‑version ranges are listed beyond the mention that the issue is fixed in 3.8.6, so any earlier release should be considered impacted.

The Common Vulnerability Scoring System assigns a score of 9.8, reflecting a critical severity. No EPSS score is available, and the vulnerability is not currently listed in CISA’s KEV catalog, yet the inability to authenticate provides a wide attack surface. An attacker can exploit the flaw by sending a crafted POST request to /html/socio/sistema/cadastro_cobranca.php without credentials, executing arbitrary SQL statements with full database privileges. Given the high CVSS score and the lack of protective controls, remediation should be taken immediately.