This flaw arises from using extract($_REQUEST) to ingest form‑encoded POST data and inserting the values directly into an unparameterized INSERT statement. Numeric values are not quoted, and string values can escape the single‑quoted context, enabling an attacker to inject arbitrary SQL. The vulnerability therefore permits reading or altering billing, member, employee, permission, and credential tables, and even dropping entire tables. No authentication is required to reach the vulnerable endpoint, making it readily exploitable by any remote user who can reach the application.

The WeGIA web manager from LabRedesCefetRJ is affected in all releases prior to version 3.8.6. The specific endpoint vulnerable is html/socio/sistema/cadastro_cobrancas_geracao.php. Users running any pre‑3.8.6 build should consider this product vulnerable.

The CVSS score of 9.8 places this flaw in the critical range, and the lack of authentication on the endpoint makes the impact very high. Although EPSS is not available, the vulnerability is listed as not in KEV, implying that no widespread exploitation is yet documented, but the path to exploitation is simple: an unauthenticated HTTP POST can be crafted to inject arbitrary SQL. The risk is significant because the injection can expose sensitive financial or personal data and potentially remove database structures, leading to service disruption. The combination of a critical severity score, straightforward exploitation, and lack of protective controls demands immediate attention.