PT-2025-47519 · Unknown · Openstamanager

Published 2025-11-19 · Updated 2025-11-21 · CVE-2025-65103

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions prior to 2.9.5

Description OpenSTAManager is a management software for technical assistance and invoicing. A SQL Injection flaw exists in the API that allows authenticated users to execute arbitrary SQL queries, regardless of their permission level. By manipulating the display parameter in an API request, an attacker can potentially exfiltrate, modify, or delete data from the database, potentially leading to a full system compromise.

Recommendations Update to version 2.9.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-65103

GHSA-2JM2-2P35-RP3J

Affected Products

Openstamanager

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65103.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-65103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65103 · Security Note
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j · Note
• https://twitter.com/VulmonFeeds/status/1991353192576057821 · Twitter Post
• https://t.me/cveNotify/143583 · Telegram Post
• https://twitter.com/CveFindCom/status/1991245326842269808 · Twitter Post
• https://t.me/CVEtracker/37773 · Telegram Post
• https://twitter.com/CVEnew/status/1991409467649327525 · Twitter Post
• https://twitter.com/gothburz/status/1991620211355623768 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p2z55i/resumen_diario_de_vulnerabilidades_21112025 · Reddit Post