PT-2026-6769 · Unknown · Openstamanager

Published 2026-02-06 · Updated 2026-02-06 · CVE-2025-69216

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and earlier

Description OpenSTAManager is susceptible to an authenticated SQL injection issue within the Scadenzario (Payment Schedule) print template. Any authenticated user can exploit this to extract sensitive data from the database, including admin credentials, customer information, and financial records. The vulnerability resides in the templates/scadenzario/init.php file, specifically where the id anagrafica parameter is directly incorporated into an SQL query without adequate sanitization. This allows for complete database read access through error-based SQL injection techniques. The vulnerable API endpoint is /pdfgen.php?ptype=scadenzario&id anagrafica=[INJECTION PAYLOAD]. The vulnerable parameter is id anagrafica.

Recommendations Versions prior to 2.9.8 are vulnerable.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-69216

GHSA-Q6G3-FV43-M2W6

Affected Products

Openstamanager

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69216.json · Exploit
• https://github.com/devcode-it/openstamanager/security/advisories/GHSA-q6g3-fv43-m2w6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69216 · Security Note
• https://osv.dev/vulnerability/GHSA-q6g3-fv43-m2w6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69216 · Vendor Advisory
• https://github.com/devcode-it/openstamanager · Note
• https://twitter.com/CVEnew/status/2019847321677095030 · Twitter Post