Openstamanager CVE-2026-35168

Authenticated attacker with access to OpenSTAManager Aggiornamenti (Updates) module versions prior to 2.10.2. Attacker sends crafted JSON POST request to op=risolvi-conflitti-database endpoint containing arbitrary SQL statements. No user interaction required.

Real-world risk is HIGH for organizations using affected OpenSTAManager versions, despite requiring authentication (PR:L). The CVSS 8.8 score accurately reflects severity: network-accessible (AV:N), low complexity (AC:L), no user interaction (UI:N), and complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H). While the PR:L requirement provides some protection against external attackers, the barrier is minimal-any authenticated user with access to the Aggiornamenti module becomes a critical threat. No EPSS data is available for this 2026-dated CVE, and no CISA KEV listing exists, indicating no confirmed active exploitation. However, the technical simplicity (submitting JSON POST data), the complete lack of input validation, and the availability of proof-of-concept information in the GitHub security advisory (GHSA-2fr7-cc4f-wh98) make exploitation trivial for attackers who gain legitimate credentials. The SSVC framework would rate this as having high technical impact (total system compromise possible), medium-to-high automatable potential (straightforward API abuse), and requiring immediate attention in environments where insider threats or credential compromise are realistic scenarios. Organizations should prioritize patching over workarounds given the fundamental design flaw.

An attacker who compromises credentials for any OpenSTAManager user account with access to the Updates module navigates to the conflict resolution interface and crafts a malicious POST request containing a JSON array of SQL commands such as SELECT statements with password hashes INTO OUTFILE for exfiltration, UPDATE commands to modify invoice amounts or customer records, DROP TABLE commands to destroy audit logs, or CREATE USER statements to establish persistent database access. Because the application executes these commands directly with disabled foreign key checks and no validation, the attacker achieves complete database control in a single HTTP request, potentially pivoting to operating system access via MySQL's file write capabilities or UDF exploitation. The low attack complexity and network accessibility mean this can be executed remotely through the web interface without requiring specialized tools beyond standard HTTP clients.