8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24416

CVE-2026-24416: OpenSTAManager has a Time-Based Blind SQL Injection in Article Pricing Module

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the article pricing completion handler. The application fails to properly sanitize the idarticolo parameter before using it in SQL queries, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24416

CVE-2026-24416:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devcode-it/openstamanager	composer	<= 2.9.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a time-based blind SQL injection in the article pricing module of OpenSTAManager. The analysis started by examining the provided vulnerability description, which pointed to the idarticolo parameter in the /ajax_complete.php endpoint as the source of the issue. The description detailed the execution flow, starting from /ajax_complete.php, which calls AJAX::complete, and then AJAX::getCompleteResults. This last function uses require to execute the script /modules/articoli/ajax/complete.php.

The vulnerability lies within this script, where a UNION SQL query is constructed. In the second part of the UNION, the $idarticolo variable, containing user-provided input, is concatenated directly into the query string without proper sanitization, while other variables in the same query are correctly sanitized using the prepare() function. This inconsistency is the root cause of the vulnerability.

To find the patch, I analyzed the commits between the vulnerable version 2.9.8 and the next available tag, v2.10-beta. A commit with the message 'fix: prevenzione sql injection' (bae00c0597b7a537569bec775f7999547f6dda9b) was identified. This commit contains a fix in /modules/articoli/ajax/complete.php that wraps the $idarticolo variable with the prepare() function, effectively mitigating the SQL injection vulnerability. The functions AJAX::complete and AJAX::getCompleteResults are identified as the vulnerable functions because they are the methods in the call stack that lead to the execution of the vulnerable script, and they would appear in a runtime profile during exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.