CVE-2026-24417CWE-89

OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

High · published February 6, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

OpenSTAManager is an open source management software for technical assistance and invoicing. OpenSTAManager v2.9.8 and earlier contain a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the term parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00412 · 34.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-06T18:07Z
EPSS history
Timeline
  • 06 FEB 18:07Z
    OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
    cvelistv5