The vulnerability in OpenSTAManager allows attackers to inject arbitrary SQL statements through the 'righe' GET parameter used in confronta_righe.php. This direct concatenation without sanitization or parameterization permits the retrieval of any database content, including user credentials, customer data, invoices, and other stored information. The weakness aligns with CWE-89, highlighting a classic SQL injection flaw that jeopardizes database confidentiality and integrity.

The affected product is OpenSTAManager from devcode-it. All releases prior to version 2.10.2 are vulnerable, while the issue is remedied in the 2.10.2 release. The software provides management, invoicing, and technical assistance functions, and the flaw resides across multiple modules that employ confronta_righe.php.

With a CVSS score of 8.8 the vulnerability is classified as high severity; however, the EPSS score is below 1%, indicating a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated within the application to reach the vulnerable parameter, suggesting the attack vector is likely an authenticated web request. Once accessed, the attacker can execute arbitrary SQL to exfiltrate sensitive data.