OpenSTAManager v2.9.8 and earlier allow attackers to inject arbitrary SQL into the global search functionality because the term parameter is not sanitized before being used in LIKE clauses. This Time-Based Blind SQL Injection lets attackers perform Boolean inference to extract sensitive data from the database. The main impact is the potential disclosure of confidential information.

The vulnerability affects the devcode-it OpenSTAManager product for versions 2.9.8 and all earlier releases. Users running those versions on any supported platform are susceptible.

The CVSS score of 8.7 signifies a high severity, but the EPSS score is under 1%, indicating low current exploitation likelihood. The vulnerability is not included in CISA's KEV catalog. Attacks would target the web application’s search feature and typically require the attacker to be authenticated or to have access to the search interface. Because the payload is delivered via HTTP requests, the attack vector is network-based and could be performed remotely.