Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2026-24416OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module
High 8.7
In plain English
A high-severity SQL injection in openstamanager from devcode-it. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to properly sanitize the idarticolo parameter before using it in SQL queries, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | devcode-it/openstamanager | no fix listed | GHSA-p864-fqgv-92q4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| devcode-it | openstamanager | <= 2.9.8 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N