CVE-2025-65103
published 2025-11-19CVE-2025-65103: OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.32%
24.0th percentile
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devcode-it | openstamanager | < 2.9.5 | 2.9.5 |
| devcode-it | openstamanager | >= 0 < 2.9.5 | 2.9.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
ghsa·2025-11-19
CVE-2025-65103 [HIGH] CWE-89 OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
### Summary
An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.
### Details
The vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.
User input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.
```php
// User input from 'display' is
OSV
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
osv·2025-11-19
CVE-2025-65103 [HIGH] OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
### Summary
An authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the `display` parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise.
### Details
The vulnerability is located in the `retrieve()` method within `src/API/Manager.php`.
User input from the `display` GET parameter is processed without proper validation. The code strips the surrounding brackets `[]`, splits the string by commas, and then passes each resulting element directly into the `selectRaw()` function of the query builder.
```php
// User input from 'display' is
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-19
Published