Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55679— WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

Quick assessment

Affected
LabRedesCefetRJ WeGIA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WeGIA 是一款面向慈善机构的 Web 管理器。在 3.8.6 版本之前，预安装阶段的 端点可在 文件尚不存在时被访问，并处理未经身份验证的安装 POST 数据。在 Linux 重装流程中，经过精心构造的 值可被注入到由 执行的命令中。此外，安装程序还会将攻击者可控的值写入可执行的 文件，并将数据库名称 拼接到 SQL 语句中。成功利用该漏洞可导致以 Web 服务器用户身份执行命令、持久化保存攻击者控制的 PHP 配置，以及篡改或破坏应用程序及其数据。该问题已在 3.8.6 版本中得到修复。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55679

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
Source: CVE Program / CVE List V5
Vulnerability Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
LabRedesCefetRJ WeGIA < 3.8.6 -

II. Public POCs for CVE-2026-55679

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55679

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55679 (2)

Other References for CVE-2026-55679 (3)

Same Patch Batch · LabRedesCefetRJ · 2026-10-14 · 6 CVEs total

CVE-2026-55683 9.8 CRITICAL WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
CVE-2026-55684 9.8 CRITICAL WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
CVE-2026-55680 9.8 CRITICAL WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
CVE-2026-55681 8.8 HIGH WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parame
CVE-2026-55682 8.1 HIGH WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/segura

IV. Related Vulnerabilities

Same product: WeGIA
Same vendor: LabRedesCefetRJ
Same weakness: CWE-78

V. Comments for CVE-2026-55679

No comments yet

Leave a comment