Vulnerability-Lookup

CVE-2025-65103 (GCVE-0-2025-65103)

Vulnerability from cvelistv5 – Published: 2025-11-19 19:09 – Updated: 2025-11-19 20:31

Title

OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter

Summary

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-19 19:59 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M mitre root Scorecard

References

1 reference

URL	Tags
https://github.com/devcode-it/openstamanager/secu…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
devcode-it	openstamanager	Affected: < 2.9.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-65103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-19T19:59:37.339544Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-19T20:31:35.423Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openstamanager",
          "vendor": "devcode-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-19T19:09:09.209Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
        }
      ],
      "source": {
        "advisory": "GHSA-2jm2-2p35-rp3j",
        "discovery": "UNKNOWN"
      },
      "title": "OpenSTAManager has an authenticated SQL Injection vulnerability in API via \u0027display\u0027 parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-65103",
    "datePublished": "2025-11-19T19:09:09.209Z",
    "dateReserved": "2025-11-17T20:55:34.693Z",
    "dateUpdated": "2025-11-19T20:31:35.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-65103",
      "date": "2026-10-22",
      "epss": "0.0037",
      "percentile": "0.29703"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "openstamanager",
                "vendor": "devcode-it",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.9.5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5."
          },
          {
            "lang": "es",
            "value": "OpenSTAManager es un software de gesti\u00f3n de c\u00f3digo abierto para asistencia t\u00e9cnica y facturaci\u00f3n. Versiones anteriores a la versi\u00f3n 2.9.5, una vulnerabilidad de inyecci\u00f3n SQL autenticada en la API permite a cualquier usuario, independientemente de su nivel de permisos, ejecutar consultas SQL arbitrarias. Al manipular el par\u00e1metro \u0027display\u0027 en una solicitud de API, un atacante puede exfiltrar, modificar o eliminar cualquier dato en la base de datos, lo que lleva a un compromiso total del sistema. Este problema ha sido parcheado en la versi\u00f3n 2.9.5."
          }
        ],
        "id": "CVE-2025-65103",
        "lastModified": "2026-10-18T20:10:00.110",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-65103",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-19T19:59:37.339544Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-19T20:15:54.107",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-89"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

EUVD-2026-261343

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 07:00

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T07:00:57.011969+00:00",
  "id": "EUVD-2026-261343"
}

FKIE_CVE-2025-65103

Vulnerability from fkie_nvd - Published: 2025-11-19 20:15 - Updated: 2026-10-18 20:10

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "openstamanager",
          "vendor": "devcode-it",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5."
    },
    {
      "lang": "es",
      "value": "OpenSTAManager es un software de gesti\u00f3n de c\u00f3digo abierto para asistencia t\u00e9cnica y facturaci\u00f3n. Versiones anteriores a la versi\u00f3n 2.9.5, una vulnerabilidad de inyecci\u00f3n SQL autenticada en la API permite a cualquier usuario, independientemente de su nivel de permisos, ejecutar consultas SQL arbitrarias. Al manipular el par\u00e1metro \u0027display\u0027 en una solicitud de API, un atacante puede exfiltrar, modificar o eliminar cualquier dato en la base de datos, lo que lleva a un compromiso total del sistema. Este problema ha sido parcheado en la versi\u00f3n 2.9.5."
    }
  ],
  "id": "CVE-2025-65103",
  "lastModified": "2026-10-18T20:10:00.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-65103",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-19T19:59:37.339544Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-19T20:15:54.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2JM2-2P35-RP3J

Vulnerability from github – Published: 2025-11-19 21:00 – Updated: 2025-11-19 21:55

Summary

OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter

Details

Summary

An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.

Details

The vulnerability is located in the retrieve() method within src/API/Manager.php.

User input from the display GET parameter is processed without proper validation. The code strips the surrounding brackets [], splits the string by commas, and then passes each resulting element directly into the selectRaw() function of the query builder.

// User input from 'display' is taken without sanitization.
$select = !empty($request['display']) ? explode(',', substr((string) $request['display'], 1, -1)) : null;

// ...

// The unsanitized input is passed directly to `selectRaw()`.
foreach ($select as $s) {
    $query->selectRaw($s);
}

Since selectRaw() is designed to execute raw SQL expressions, it executes any malicious SQL code provided in the display parameter.

PoC

Log in to an OpenSTAManager instance as any user.
Navigate to the user's profile page to obtain their personal API Token.
Use this API token to send a specially crafted GET request to the API endpoint.

Time-Based Blind Injection Test:

Replace <your_host>, <your_token>, and <resource_name> with your actual values. anagrafiche is a valid resource.

curl "http://<your_host>/openstamanager/api?token=<your_token>&resource=anagrafiche&display=[1,SLEEP(5)]"

The server will delay its response by approximately 5 seconds, confirming the SLEEP(5) command was executed by the database.

Impact

This is a critical SQL Injection vulnerability. Any authenticated user, even those with the lowest privileges, can exploit this vulnerability to:

Exfiltrate all data from the database (e.g., user credentials, customer information, invoices, internal data).
Modify or delete data, compromising data integrity.
Potentially achieve further system compromise, depending on the database user's privileges and system configuration.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.9.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "devcode-it/openstamanager"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65103"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-19T21:00:37Z",
    "nvd_published_at": "2025-11-19T20:15:54Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.\n\n### Details\nThe vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.\n\nUser input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.\n\n```php\n// User input from \u0027display\u0027 is taken without sanitization.\n$select = !empty($request[\u0027display\u0027]) ? explode(\u0027,\u0027, substr((string) $request[\u0027display\u0027], 1, -1)) : null;\n\n// ...\n\n// The unsanitized input is passed directly to `selectRaw()`.\nforeach ($select as $s) {\n    $query-\u003eselectRaw($s);\n}\n```\n\nSince `selectRaw()` is designed to execute raw SQL expressions, it executes any malicious SQL code provided in the `display` parameter.\n\n### PoC\n1.  Log in to an OpenSTAManager instance as any user.\n2.  Navigate to the user\u0027s profile page to obtain their personal API Token.\n3.  Use this API token to send a specially crafted GET request to the API endpoint.\n\n**Time-Based Blind Injection Test:**\n\nReplace `\u003cyour_host\u003e`, `\u003cyour_token\u003e`, and `\u003cresource_name\u003e` with your actual values. `anagrafiche` is a valid resource.\n\n```bash\ncurl \"http://\u003cyour_host\u003e/openstamanager/api?token=\u003cyour_token\u003e\u0026resource=anagrafiche\u0026display=[1,SLEEP(5)]\"\n```\n\nThe server will delay its response by approximately 5 seconds, confirming the `SLEEP(5)` command was executed by the database.\n\n### Impact\nThis is a critical SQL Injection vulnerability. Any authenticated user, even those with the lowest privileges, can exploit this vulnerability to:\n\n*   **Exfiltrate all data** from the database (e.g., user credentials, customer information, invoices, internal data).\n*   **Modify or delete data**, compromising data integrity.\n*   Potentially achieve further system compromise, depending on the database user\u0027s privileges and system configuration.",
  "id": "GHSA-2jm2-2p35-rp3j",
  "modified": "2025-11-19T21:55:33Z",
  "published": "2025-11-19T21:00:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2jm2-2p35-rp3j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65103"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/devcode-it/openstamanager"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenSTAManager has Authenticated SQL Injection in API via \u0027display\u0027 parameter"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-65103 (GCVE-0-2025-65103)

EUVD-2026-261343

FKIE_CVE-2025-65103

GHSA-2JM2-2P35-RP3J

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour