Time-Based Blind SQL Injection Vulnerability in OpenSTAManager by Devcode

CVE-2026-24416

What is CVE-2026-24416?

OpenSTAManager, an open-source management software for technical assistance and invoicing, is susceptible to a Time-Based Blind SQL Injection vulnerability in its article pricing completion handler. The software inadequately sanitizes the 'idarticolo' parameter before employing it in SQL queries, which permits attackers to inject arbitrary SQL commands. This flaw enables potential data breaches by allowing malicious actors to extract sensitive information through time-based Boolean inference.

References