PT-2026-6773 · Unknown · Openstamanager

Lukasz-Rybak

·

Published

2026-02-06

·

Updated

2026-02-09

·

CVE-2026-24417

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions OpenSTAManager versions 2.9.8 and earlier
Description OpenSTAManager contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application does not properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference. The vulnerability affects multiple search modules and has amplified execution, meaning a single malicious request can trigger SQL injection across all vulnerable modules simultaneously, increasing the delay and potentially causing server issues. The vulnerable parameter is term and is used in the /ajax search.php endpoint. Affected modules include Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, and Interventi. The vulnerability allows for complete database exfiltration, including customer Personally Identifiable Information (PII), financial records, and business secrets, as well as the extraction of password hashes.
Recommendations Replace all instances of direct $term concatenation with prepare() in the following files:
  • /modules/articoli/ajax/search.php - Line 51
  • /modules/ordini/ajax/search.php - Lines 43, 47, 79
  • /modules/ddt/ajax/search.php - Lines 43, 47, 83
  • /modules/fatture/ajax/search.php - Lines 45, 49, 85
  • /modules/preventivi/ajax/search.php - Lines 45, 49, 83
  • /modules/anagrafiche/ajax/search.php - Lines 62, 107, 162
  • /modules/impianti/ajax/search.php - Line 46

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-24417
GHSA-4HC4-8599-XH2H

Affected Products

Openstamanager