Executive brief
OpenSTAManager, an open-source platform for technical assistance and invoicing, contains a security flaw in several of its core modules. An authorized user can exploit this vulnerability to gain unauthorized access to the entire database, potentially exposing sensitive customer information, financial records, and login credentials. This could lead to a total breach of data confidentiality and integrity for organizations using the software.
Technical details
An SQL injection vulnerability exists in OpenSTAManager versions prior to 2.10.2 due to improper sanitization of the 'righe' GET parameter in 'confronta_righe.php' files across multiple modules (including invoices, interventions, and contracts). The application directly concatenates the 'righe' parameter into SQL IN() clauses without using parameterized queries or input validation. An authenticated attacker with low privileges can exploit this via network requests to execute arbitrary SQL commands. This allows for the extraction of sensitive data via error-based techniques (e.g., EXTRACTVALUE) or potential data modification through stacked queries. The issue is resolved in version 2.10.2 by implementing the prepare() function for SQL escaping.
Affected products
- devcode-it OpenSTAManager < 2.10.2
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: NVD publication date
- 2026-03-17: patched: Version 2.10.2 released