CVE-2026-28411 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: WeGIA v3.6.5- uses `extract()` on `$_REQUEST` unsafely. 💥 **Consequences**: Attackers overwrite local variables, bypassing auth checks entirely. Total system compromise possible.

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-288**: Authentication Bypass. 🐛 **Flaw**: Insecure use of `extract()` function on the `$_REQUEST` superglobal variable. No validation before variable injection.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: LabRedesCefetRJ (Nilson Lazarin). 📦 **Product**: WeGIA (Network Manager for welfare institutions). ⚠️ **Affected**: Versions **before 3.6.5**.

Q: What can hackers do? (Privileges/Data)

🔓 **Privileges**: Full Authentication Bypass. 🕵️ **Action**: Overwrite local variables to impersonate users. 📉 **Impact**: High (CVSS 9.8). Complete access to sensitive data and system control.

Q: Is exploitation threshold high? (Auth/Config)

📶 **Threshold**: LOW. 🚫 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🌐 **Network**: Remote (AV:N). Easy to exploit from anywhere.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No PoC code provided in data. 🔍 **Status**: Advisory confirmed via GitHub (GHSA-g7r9-hxc8-8vh7). Wild exploitation likely due to low complexity.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for WeGIA instances. 📋 **Verify**: Check version number < 3.6.5. 🧪 **Test**: Look for `extract($_REQUEST)` patterns in PHP source code. ⚠️ **Risk**: High if unpatched.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade to **WeGIA 3.6.5** or later. 📥 **Source**: Official GitHub Advisory (LabRedesCefetRJ/WeGIA). ✅ **Status**: Patch available.

Q: What if no patch? (Workaround)

🚧 **Workaround**: If upgrading impossible, disable `extract()` usage on `$_REQUEST`. 🔒 **Mitigate**: Implement strict input validation and variable whitelisting. 🚫 **Block**: Restrict network access to the service.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 📈 **Priority**: P1. 🚨 **Reason**: CVSS 9.8, Remote, No Auth, Auth Bypass. Immediate patching required to prevent total takeover.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: WeGIA v3.6.5- uses `extract()` on `$_REQUEST` unsafely. 💥 **Consequences**: Attackers overwrite local variables, bypassing auth checks entirely. Total system compromise possible.

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-288**: Authentication Bypass. 🐛 **Flaw**: Insecure use of `extract()` function on the `$_REQUEST` superglobal variable. No validation before variable injection.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: LabRedesCefetRJ (Nilson Lazarin). 📦 **Product**: WeGIA (Network Manager for welfare institutions). ⚠️ **Affected**: Versions **before 3.6.5**.

Q4What can hackers do? (Privileges/Data)

🔓 **Privileges**: Full Authentication Bypass. 🕵️ **Action**: Overwrite local variables to impersonate users. 📉 **Impact**: High (CVSS 9.8). Complete access to sensitive data and system control.

Q5Is exploitation threshold high? (Auth/Config)

📶 **Threshold**: LOW. 🚫 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🌐 **Network**: Remote (AV:N). Easy to exploit from anywhere.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp**: No PoC code provided in data. 🔍 **Status**: Advisory confirmed via GitHub (GHSA-g7r9-hxc8-8vh7). Wild exploitation likely due to low complexity.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for WeGIA instances. 📋 **Verify**: Check version number < 3.6.5. 🧪 **Test**: Look for `extract($_REQUEST)` patterns in PHP source code. ⚠️ **Risk**: High if unpatched.

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade to **WeGIA 3.6.5** or later. 📥 **Source**: Official GitHub Advisory (LabRedesCefetRJ/WeGIA). ✅ **Status**: Patch available.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If upgrading impossible, disable `extract()` usage on `$_REQUEST`. 🔒 **Mitigate**: Implement strict input validation and variable whitelisting. 🚫 **Block**: Restrict network access to the service.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 📈 **Priority**: P1. 🚨 **Reason**: CVSS 9.8, Remote, No Auth, Auth Bypass. Immediate patching required to prevent total takeover.

Continue exploring

Vulnerability detail Full AI analysis (login) LabRedesCefetRJ CWE-288