OpenSTAManager suffers a time‑based blind SQL injection that arises from the unvalidated options[stato] GET parameter in several AJAX select handlers. The user supplied value is placed directly into a SQL WHERE clause as a bare expression, allowing an attacker to inject arbitrary SQL instructions. This enables the extraction of sensitive information such as usernames, password hashes, financial records, and any other data stored in the MySQL database. The vulnerability leverages broken input handling (CWE‑89) and can lead to a full data compromise if exploited.

The issue impacts the devcode‑it OpenSTAManager application. All releases prior to version 2.10.2 are affected. The patch referenced in the commit logs and release notes of v2.10.2 resolves the injection vector by sanitizing the options[stato] input and parameterizing the SQL statement.

The CVSS score of 8.8 classifies this as high severity, indicating significant risk. Although EPSS information is not available, the attack path requires an authenticated session and the ability to request the vulnerable AJAX endpoint, which is typically accessible to legitimate users with access rights. The vulnerability is not listed in CISA’s KEV catalog, but the underlying data exposure risk remains substantial. The likely attack vector is a crafted AJAX request from an authenticated user's browser, potentially amplified by login privileges.