CVE-2026-55679 in WeGIA
Summary
by MITRE • 10/15/2026
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in WeGIA versions prior to 3.8.6 represents a critical failure in secure software installation practices, specifically involving unauthenticated remote code execution and configuration manipulation within the web-based installer component. The core issue stems from the accessibility of the pre-installation endpoint located at web/instalador/instalador.php before the application's primary configuration file, config.php, has been generated or exists on the server filesystem. This architectural oversight allows an attacker to interact with the installation logic without any form of authentication or authorization checks that would typically be enforced once a system is fully configured and operational. By targeting this specific endpoint during the initial setup phase or potentially in scenarios where the configuration file is missing due to corruption or misconfiguration, adversaries can inject malicious payloads directly into the application's processing pipeline.
The technical exploitation mechanism relies on two distinct but related attack vectors facilitated by the installer script. First, within the Linux reinstall flow, the application processes a user-supplied parameter named usuario without adequate sanitization before passing it to shell_exec(). This function executes system commands using the privileges of the web server process, such as www-data or apache. Consequently, an attacker can craft a malicious value for this field that includes command injection characters, leading to arbitrary command execution on the underlying operating system with the same permissions as the web service itself. Second, the installer exhibits insecure file handling and SQL construction practices by writing attacker-controlled values directly into the executable config.php file. Furthermore, it concatenates user-supplied input, specifically the database name field named nomebd, directly into a CREATE DATABASE statement without proper escaping or validation. This allows for both persistent configuration tampering and potential SQL injection attacks against the database management system during the initialization phase.
The operational impact of this vulnerability is severe, encompassing full server compromise through remote code execution, persistence via malicious PHP configurations, and data integrity risks through database manipulation. Successful exploitation enables an attacker to gain a foothold within the web server's environment, potentially leading to lateral movement across internal networks or access to sensitive charitable institution data stored in the associated databases. The ability to write arbitrary content into config.php ensures that even if the initial command execution is detected and mitigated, the attacker can maintain persistent control over the application by injecting backdoors or altering authentication logic within the configuration file. Additionally, the manipulation of database creation processes could result in denial of service conditions or data exfiltration depending on how the subsequent SQL queries are handled by the underlying database engine.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). From a tactical perspective, it maps to MITRE ATT&CK techniques including T1059 Command and Scripting Interpreter for the shell execution aspect and T1505 Server Software Component for the persistence via configuration file modification. To mitigate this risk, organizations must ensure that WeGIA is updated to version 3.8.6 or later where these flaws have been addressed. For systems running older versions, immediate remediation involves restricting access to the installer directory through web server configuration rules until a patch can be applied. It is also critical to verify that config.php has appropriate file permissions set to prevent unauthorized writes and to audit existing installations for any signs of persistent backdoors or unexpected database structures resulting from prior exploitation attempts.