The vulnerability resides in the Prima Nota (Journal Entry) module of OpenSTAManager, where the add.php script does not validate that the comma‑separated values in the id_documenti GET parameter are integers before incorporating them into SQL IN() clauses. This flaw permits attackers to inject arbitrary SQL code, resulting in error-based data extraction via XPATH error messages. The weakness is classified as CWE‑89 and can lead to unauthorized data disclosure and potential manipulation of the database.

The flaw affects the devcode‑it OpenSTAManager product, specifically versions 2.9.8 and earlier. Any deployment of OpenSTAManager that includes the vulnerable add.php module and processes the id_documenti parameter through a publicly accessible web interface is at risk.

With a CVSS score of 8.7 and an EPSS score of less than 1%, the vulnerability presents a high severity but a low likelihood of exploitation under current conditions. It is not listed in the CISA KEV catalog. The attack vector is primarily remote, via crafted HTTP GET requests to the add.php endpoint. If exploited, an attacker can read confidential data and potentially influence database contents, depending on the underlying database permissions.