CVE-2026-35168 Details
Description
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes them directly against the database without any validation, allowlist, or sanitization. An authenticated attacker with access to the Aggiornamenti module can execute arbitrary SQL statements including CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, and any other SQL command supported by the MySQL server. Foreign key checks are explicitly disabled before execution (SET FOREIGN_KEY_CHECKS=0), further reducing database integrity protections. This issue has been patched in version 2.10.2.
A SQL injection vulnerability has been identified in the Aggiornamenti (Updates) module of OpenSTAManager, prior to version 2.10.2. The vulnerability arises from a database conflict resolution feature that allows authenticated users to send arbitrary SQL commands via a JSON array, which are then executed directly on the database without any validation or sanitization. This exploitation can lead to unauthorized database modifications, including the execution of destructive SQL commands. Additionally, foreign key checks are disabled before executing the injected queries, further compromising database integrity.
Users can update to OpenSTAManager version 2.10.2 or later, where this vulnerability has been patched. Instructions for downloading the latest version are available on the OpenSTAManager GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/devcode-it/openstamanager/commit/43970676bcd6636ff8663652fd82579f737abb74 | [email protected] | Patch |
| https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2 | [email protected] | ProductRelease Notes |
| https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| devcode openstamanager | < 2.10.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | New CVE Received | [email protected] |