CVE-2026-40285: WeGIA SQL Injection via PHP extract() Session Override (CVSS 8.8)

Executive Summary

CVE-2026-40285 is a high-severity SQL injection vulnerability (CVSS 8.8) affecting WeGIA, an open-source web manager designed for charitable and non-profit institutions. The flaw exists in dao/memorando/UsuarioDAO.php and is enabled by PHP's dangerous extract($_REQUEST) function in DespachoControle::verificarDespacho(), which allows an attacker to overwrite the session-stored user identity by supplying a crafted cpf_usuario POST parameter.

All versions prior to 3.6.10 are affected. A patch is available.

Vulnerability Overview

Affected Versions

Technical Analysis

What Is WeGIA?

WeGIA (Web Gestor para Instituições de Assistência) is an open-source PHP-based web management system built for charitable institutions, NGOs, and social welfare organizations. It handles volunteer management, beneficiary records, memos, and administrative functions for organizations serving vulnerable populations.

Root Cause: PHP extract() on Request Data

The vulnerability originates in the DespachoControle::verificarDespacho() method, which calls:

extract($_REQUEST);

The PHP extract() function imports variables from an array into the current symbol table. When applied to user-controlled superglobals like $_REQUEST, $_POST, or $_GET, it creates a severe security vulnerability: any variable that exists in the session or local scope can be silently overwritten by an attacker-supplied parameter with the same name.

In this case:

• The application stores the currently authenticated user's identifier in a session variable
• The controller calls extract($_REQUEST) before performing business logic
• A POST parameter named cpf_usuario (the Brazilian CPF — a national tax ID used as a user key) collides with the session-stored identity variable
• The attacker-supplied cpf_usuario replaces the legitimate session value before the database query executes

SQL Injection Stage

Once the session variable is overridden, the tainted cpf_usuario value flows directly into a PDO query in UsuarioDAO.php without sufficient sanitization. Although PDO is the query interface, the vulnerability is not in a parameterized binding — the cpf_usuario value is incorporated into the query in a way that allows injection.

Attack flow:

1. Attacker authenticates as a low-privilege user
2. Sends a POST request to the vulnerable endpoint with cpf_usuario=<payload>
3. extract($_REQUEST) overwrites the session-stored user identity
4. The tainted value is passed to UsuarioDAO without sanitization
5. SQL injection executes — attacker can read/modify/delete database records
6. Attacker achieves privilege escalation to higher-privilege user accounts

Why This Is Rated CVSS 8.8

The CVSS score is bounded at 8.8 (rather than 9+) because low-privilege authentication is required — however, the practical barrier for exploitation is minimal in any multi-user WeGIA deployment.

Impact Assessment

Remediation

Upgrade to WeGIA 3.6.10

# Pull the latest release from GitHub
git clone https://github.com/WeGIA/WeGIA.git
cd WeGIA
git checkout v3.6.10
 
# Or download the release archive directly
# https://github.com/WeGIA/WeGIA/releases/tag/v3.6.10

Immediate Mitigations (if patching is delayed)

1. Remove or replace extract($_REQUEST) — replace with explicit variable assignments to eliminate the root cause:

   // Instead of: extract($_REQUEST);
   $cpf_usuario = $_SESSION['cpf_usuario']; // always use session, never request

   Copy

2. Use parameterized queries throughout UsuarioDAO.php — ensure all PDO interactions use bound parameters

3. Restrict access to the vulnerable endpoint to known internal IP ranges if the panel is not internet-facing

4. Audit all PHP files for additional uses of extract() on user-controlled superglobals — this pattern is likely present elsewhere in the codebase

Detection

Post-Remediation Checklist

1. Upgrade all WeGIA instances to 3.6.10 or later
2. Audit all uses of extract() on $_REQUEST, $_POST, or $_GET in the codebase
3. Review database logs for anomalous queries during the vulnerability window
4. Rotate credentials for all user accounts if unauthorized access is suspected
5. Notify beneficiaries if personal data was accessed, per applicable data protection obligations
6. Enable WAF rules to block SQL injection patterns at the perimeter

References

• NVD — CVE-2026-40285
• WeGIA GitHub Repository
• PHP Documentation — extract() Security Warning