CVE-2026-28805

{
  "id": "CVE-2026-28805",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-02T14:16:26.400",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2."
    },
    {
      "lang": "es",
      "value": "OpenSTAManager es un software de gestión de código abierto para asistencia técnica y facturación. Antes de la versión 2.10.2, múltiples manejadores de selección AJAX en OpenSTAManager son vulnerables a inyección SQL ciega basada en tiempo a través del parámetro GET options[stato]. El valor proporcionado por el usuario se lee de $superselect[’stato’] y se concatena directamente en cláusulas SQL WHERE como una expresión sin procesar, sin ninguna sanitización, parametrización o validación de lista de permitidos. Un atacante autenticado puede inyectar sentencias SQL arbitrarias para extraer datos sensibles de la base de datos, incluyendo nombres de usuario, hashes de contraseñas, registros financieros y cualquier otra información almacenada en la base de datos MySQL. Este problema ha sido parcheado en la versión 2.10.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "devcode-it",
          "product": "openstamanager",
          "versions": [
            {
              "version": "< 2.10.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T18:30:58.710195Z",
          "id": "CVE-2026-28805",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.10.2",
              "matchCriteriaId": "37690084-64E6-4E8B-8A92-8B55C8FC1E9F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/devcode-it/openstamanager/commit/50b9089c506ba2ca249afb1dfead2af5d42c10e7",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/commit/679c40fa5b3acad4263b537f367c0695ff9666dc",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-3gw8-3mg3-jmpc",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}