CNNVD-202602-973 Information
CNNVD ID
CNNVD-202602-973
Related CVE
- CNNVD Published: 2026-02-06
Description (Chinese)
OpenSTAManager是Devcode开源的一个用于技术援助和计费的开源管理软件。 OpenSTAManager 2.9.8及之前版本存在SQL注入漏洞，该漏洞源于Scadenzario打印模板中id_anagrafica参数未经过适当清理直接拼接到SQL查询，可能导致任何已验证用户通过基于错误的SQL注入技术提取数据库中的敏感数据。
Description (English)
OpenSTAManager is an open source management software for technical assistance and costing from Devcode. OpenSTAManager 2.9.8 and previous versions contain an injection loophole in SQL, which stems from the fact that the id anagrafica parameter in the Scadenzario print template has not been properly cleaned up and is directly linked to SQL queries, which may result in any validated user extracting sensitive data from the database through error-based SQL injection techniques.
Hazard Level
High
Vulnerability Type
SQL注入
Affected Vendor
Devcode
Published
2026-02-06
Last Modified
2026-02-24
References
https://github.com/devcode-it/openstamanager/security/advisories/GHSA-q6g3-fv43-m2w6
Share on: