Time-Based Blind SQL Injection in OpenSTAManager Affects Data Security

CVE-2026-24417

What is CVE-2026-24417?

OpenSTAManager, an open-source management software designed for technical assistance and invoicing, is susceptible to a Time-Based Blind SQL Injection vulnerability. This flaw exists in the global search functionality, where the application inadequately sanitizes the 'term' parameter in SQL LIKE clauses across multiple search handlers. As a result, attackers can exploit this weakness to inject arbitrary SQL commands, potentially allowing them to extract sensitive information through time-based Boolean inference, thereby compromising the security of the application.

References