CVE-2026-35168

{"id": "CVE-2026-35168", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35168", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T16:19:18.702127Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "devcode-it", "product": "openstamanager", "versions": [{"status": "affected", "version": "< 2.10.2"}]}]}], "published": "2026-04-02T14:16:31.543", "references": [{"url": "https://github.com/devcode-it/openstamanager/commit/43970676bcd6636ff8663652fd82579f737abb74", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (Updates) module in OpenSTAManager contains a database conflict resolution feature (op=risolvi-conflitti-database) that accepts a JSON array of SQL statements via POST and executes them directly against the database without any validation, allowlist, or sanitization. An authenticated attacker with access to the Aggiornamenti module can execute arbitrary SQL statements including CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, and any other SQL command supported by the MySQL server. Foreign key checks are explicitly disabled before execution (SET FOREIGN_KEY_CHECKS=0), further reducing database integrity protections. This issue has been patched in version 2.10.2."}, {"lang": "es", "value": "OpenSTAManager es un software de gesti\u00f3n de c\u00f3digo abierto para asistencia t\u00e9cnica y facturaci\u00f3n. Antes de la versi\u00f3n 2.10.2, el m\u00f3dulo Aggiornamenti (Actualizaciones) en OpenSTAManager contiene una caracter\u00edstica de resoluci\u00f3n de conflictos de base de datos (op=risolvi-conflitti-database) que acepta un array JSON de sentencias SQL v\u00eda POST y las ejecuta directamente contra la base de datos sin ninguna validaci\u00f3n, lista blanca o saneamiento. Un atacante autenticado con acceso al m\u00f3dulo Aggiornamenti puede ejecutar sentencias SQL arbitrarias incluyendo CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, SELECT INTO OUTFILE, y cualquier otro comando SQL soportado por el servidor MySQL. Las comprobaciones de clave externa se deshabilitan expl\u00edcitamente antes de la ejecuci\u00f3n (SET FOREIGN_KEY_CHECKS=0), reduciendo a\u00fan m\u00e1s las protecciones de integridad de la base de datos. Este problema ha sido parcheado en la versi\u00f3n 2.10.2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devcode:openstamanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37690084-64E6-4E8B-8A92-8B55C8FC1E9F", "versionEndExcluding": "2.10.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}