8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24418

CVE-2026-24418: OpenSTAManager has an SQL Injection vulnerability in the Scadenzario bulk operations module

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records array are integers before using them in an SQL IN() clause, allowing attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24418

CVE-2026-24418:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devcode-it/openstamanager	composer	<= 2.9.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic error-based SQL injection in the bulk operations of the Scadenzario module. The root cause is the failure to properly sanitize user-provided input before incorporating it into a database query.

The exploitation flow begins when an authenticated user sends a POST request to /actions.php with a malicious payload in the id_records[] parameter. The actions.php script retrieves this array and passes it to the array_clean() function located in lib/util.php. This function is flawed as it only removes empty values but does not validate the data type, allowing SQL injection payloads to remain.

Subsequently, actions.php includes /modules/scadenzario/bulk.php. Inside this file, the unsanitized $id_records array is directly concatenated into a SQL SELECT statement using implode(',', $id_records). This dynamically constructed query is then executed by the $database->FetchArray() method. The lack of input validation and use of prepared statements at this stage allows an attacker to inject malicious SQL and exfiltrate database contents, such as user credentials and financial records, by manipulating the database to return information within error messages.

Vulnerable functions

array_clean

lib/util.php

This function is part of the vulnerability chain. It is intended to sanitize an array of record IDs, but it only removes empty elements without validating that the remaining elements are integers. This allows malicious SQL injection payloads to be preserved in the array and passed to the database query.

FetchArray

modules/scadenzario/bulk.php

This function (a method of the database object) executes the raw SQL query. The query is constructed by unsafely concatenating user-controlled input from the `$id_records` array. Because the input is not validated or escaped, an attacker can inject arbitrary SQL commands into the `IN` clause, leading to data extraction via error messages.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.