CVE-2026-35168

{
  "id": "CVE-2026-35168",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-02T14:16:31.543",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes them directly against the database without any validation, allowlist, or sanitization. An authenticated attacker with access to the Aggiornamenti module can execute arbitrary SQL statements including CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, and any other SQL command supported by the MySQL server. Foreign key checks are explicitly disabled before execution (SET FOREIGN_KEY_CHECKS=0), further reducing database integrity protections. This issue has been patched in version 2.10.2."
    },
    {
      "lang": "es",
      "value": "OpenSTAManager es un software de gestión de código abierto para asistencia técnica y facturación. Antes de la versión 2.10.2, el módulo Aggiornamenti (Actualizaciones) en OpenSTAManager contiene una característica de resolución de conflictos de base de datos (op=risolvi-conflitti-database) que acepta un array JSON de sentencias SQL vía POST y las ejecuta directamente contra la base de datos sin ninguna validación, lista blanca o saneamiento. Un atacante autenticado con acceso al módulo Aggiornamenti puede ejecutar sentencias SQL arbitrarias incluyendo CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, y cualquier otro comando SQL soportado por el servidor MySQL. Las comprobaciones de clave externa se deshabilitan explícitamente antes de la ejecución (SET FOREIGN_KEY_CHECKS=0), reduciendo aún más las protecciones de integridad de la base de datos. Este problema ha sido parcheado en la versión 2.10.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "devcode-it",
          "product": "openstamanager",
          "versions": [
            {
              "version": "< 2.10.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T16:19:18.702127Z",
          "id": "CVE-2026-35168",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.10.2",
              "matchCriteriaId": "37690084-64E6-4E8B-8A92-8B55C8FC1E9F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/devcode-it/openstamanager/commit/43970676bcd6636ff8663652fd82579f737abb74",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}