CVE-2026-24418 Details
Description
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records array are integers before using them in an SQL IN() clause, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.
A critical error-based SQL injection vulnerability has been identified in OpenSTAManager versions prior to 2.9.8. The issue resides in the bulk operations handler of the Scadenzario (Payment Schedule) module. The vulnerability arises because the application does not properly validate the elements of the id_records array, allowing attackers to inject arbitrary SQL commands. This exploitation can lead to the extraction of sensitive data, such as user credentials and financial records, through XML error messages.
The vulnerability can be addressed by implementing proper validation of the 'id_records' array to ensure that all elements are integers before they are used in the SQL IN() clause. This can be done by applying a type validation that filters the array to include only positive integer values.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/devcode-it/openstamanager/security/advisories/GHSA-4xwv-49c8-fvhq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| devcode openstamanager | <= 2.9.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 9, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | New CVE Received | [email protected] |