CVE-2026-31896

{"id": "CVE-2026-31896", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-11T20:16:15.797", "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-w7g3-87cr-8m83", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover_produto_ocultar.php script uses extract($_REQUEST) to populate local variables and then directly concatenates these variables into a SQL query executed via PDO::query. This allows an authenticated (or auth-bypassed) attacker to execute arbitrary SQL commands. This can be used to exfiltrate sensitive data from the database or, as demonstrated in this PoC, cause a time-based delay (denial of service). This vulnerability is fixed in 3.6.6."}, {"lang": "es", "value": "WeGIA es un gestor web para instituciones ben\u00e9ficas. Antes de la versi\u00f3n 3.6.6, existe una vulnerabilidad cr\u00edtica de inyecci\u00f3n SQL en la aplicaci\u00f3n WeGIA. El script remover_produto_ocultar.php utiliza extract($_REQUEST) para poblar variables locales y luego concatena directamente estas variables en una consulta SQL ejecutada a trav\u00e9s de PDO::query. Esto permite a un atacante autenticado (o con autenticaci\u00f3n eludida) ejecutar comandos SQL arbitrarios. Esto puede usarse para exfiltrar datos sensibles de la base de datos o, como se demuestra en esta PoC, causar un retardo basado en el tiempo (denegaci\u00f3n de servicio). Esta vulnerabilidad est\u00e1 corregida en la 3.6.6."}], "lastModified": "2026-03-13T20:05:49.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6CDCF05A-C4CA-4349-9BEC-BD27A89E1699", "versionEndExcluding": "3.6.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}