OpenSTAManager, an open source management platform, contains a time‑based blind SQL injection flaw in the AJAX select handlers that accept the options[stato] parameter. The value supplied by the user is directly inserted into SQL WHERE clauses without sanitization or parameterization. An attacker who can authenticate to the application can exploit this weakness to execute arbitrary SQL, thereby exfiltrating sensitive information such as usernames, password hashes, and financial records from the MySQL database.

All releases of Devcode‑IT OpenSTAManager prior to version 2.10.2 are affected. The vulnerability exists in the core application and can be accessed through any AJAX route that accepts the options[stato] GET parameter. Upgrade to v2.10.2 or later resolves the issue.

The severity is high with a CVSS score of 8.8, yet the EPSS score is below 1%, indicating that exploitation is currently not widely seen. The vulnerability requires user authentication and web‑based interaction, suggesting an application‑layer attack vector. Although it is not included in the CISA KEV catalog, the potential for data theft makes it a priority for remediation.