https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 02:25:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267583 EUVD-2026-267583 https://cve.radiocsirt.org/vuln/euvd-2026-267583 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24417 <p>OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.</p> <p>OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-24417 https://cve.radiocsirt.org/vuln/ghsa-4hc4-8599-xh2h <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>### Summary</p> <p>Critical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules.</p> <p>**Status:** ✅ Confirmed and tested on live instance (v2.9.8) **Vulnerable Parameter:** `term` (GET) **Affected Endpoint:** `/ajax_search.php` **Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, Interventi</p> <p>### Details</p> <p>OpenSTAManager v2.9.8 contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.</p> <p>**Vulnerability Chain:**</p> <p>1. **Entry Point:** `/ajax_search.php` (Line 30-31) ```php $term = get(&#39;term&#39;); $term = str_replace(&#39;/&#39;, &#39;\\/&#39;, $term); ``` The `$term` parameter undergoes minimal sanitization (only forward slash replacement).</p> <p>2. **Distribution:** `/src/AJAX.php::search()` (Line 159-161) ```php $files = self::find(&#39;ajax/search.php&#39;); array_unshift($files, base_dir().&#39;/ajax_search.php&#39;); foreach ($files as $file) { $module_r…</p> <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>### Summary</p> <p>Critical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules.</p> <p>**Status:** ✅ Confirmed and tested on live instance (v2.9.8) **Vulnerable Parameter:** `term` (GET) **Affected Endpoint:** `/ajax_search.php` **Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, Interventi</p> <p>### Details</p> <p>OpenSTAManager v2.9.8 contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.</p> <p>**Vulnerability Chain:**</p> <p>1. **Entry Point:** `/ajax_search.php` (Line 30-31) ```php $term = get(&#39;term&#39;); $term = str_replace(&#39;/&#39;, &#39;\\/&#39;, $term); ``` The `$term` parameter undergoes minimal sanitization (only forward slash replacement).</p> <p>2. **Distribution:** `/src/AJAX.php::search()` (Line 159-161) ```php $files = self::find(&#39;ajax/search.php&#39;); array_unshift($files, base_dir().&#39;/ajax_search.php&#39;); foreach ($files as $file) { $module_r…</p> https://cve.radiocsirt.org/vuln/ghsa-4hc4-8599-xh2h