A flaw in the Aggiornamenti module of OpenSTAManager permits an authenticated user to submit a JSON array of raw SQL statements that are executed directly against the MySQL database without any validation or sanitization. This allows the attacker to perform CREATE, DROP, ALTER, INSERT, UPDATE, DELETE, or even SELECT INTO OUTFILE commands, effectively giving them full SQL injection capabilities and the ability to disable foreign key checks before execution, further undermining database integrity.

The vulnerability affects the OpenSTAManager product by devcode-it, specifically all releases prior to version 2.10.2. Users running those earlier versions with the Aggiornamenti module enabled are exposed.

The issue has a CVSS score of 8.8 and an EPSS score of less than 1%, indicating high severity but a low probability of exploitation in the wild. It is not listed in CISA’s KEV catalog. Exploitation requires authentication and access to the Aggiornamenti module; once reached, the attacker can execute arbitrary SQL and exfiltrate data or alter the database structure.