SQL Injection Vulnerability in OpenSTAManager by Devcode IT
CVE-2026-24418
Key Information:
- Vendor
Devcode-it
- Status
- Vendor
- CVE Published:
- 6 February 2026
Badges
What is CVE-2026-24418?
CVE-2026-24418 is a critical SQL Injection vulnerability present in OpenSTAManager, an open-source management application designed for technical assistance and invoicing. This vulnerability exists in versions 2.9.8 and earlier, specifically within the bulk operations handler for the Scadenzario (Payment Schedule) module. The flaw arises from the application's failure to properly validate inputs, specifically ensuring that elements within the id_records array are integers before incorporating them into SQL queries. Due to this oversight, an attacker can inject arbitrary SQL commands, which could potentially allow them to extract sensitive information from the database simply by exploiting error messages returned via XPATH. The implications of this vulnerability can significantly compromise an organization's data safety and integrity.
Potential impact of CVE-2026-24418
-
Data Breach: Attackers could leverage this vulnerability to gain unauthorized access to confidential data stored within the database, putting sensitive customer and financial information at risk.
-
Integrity Compromise: The ability to execute arbitrary SQL commands could allow attackers to alter data, creating false records or corrupting existing information, which undermines the integrity of the system.
-
Service Disruption: The exploitation of this vulnerability could result in denial of service situations, where the application becomes unresponsive or unable to process legitimate requests, disrupting business operations and client interactions.
Affected Version(s)
openstamanager <= 2.9.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.