A critical SQL injection vulnerability in OpenSTAManager allows any authenticated user to execute arbitrary database commands, leading to a potential full system compromise.

This is a SQL injection flaw (CWE-89) located in the API component. An authenticated attacker can manipulate the display parameter to perform unauthorized data exfiltration, modification, or deletion.

The vulnerability carries a CVSS score of 8.8, reflecting its high impact on data confidentiality, integrity, and availability. Successful exploitation could allow an attacker to dump sensitive customer data, modify invoicing records, or manipulate system configurations, resulting in severe financial and operational disruption.

Immediate Action: Update the OpenSTAManager installation to version 2.9.5 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Review application and database logs for anomalous queries, specifically those involving the display parameter or unusual SQL syntax originating from low-privileged user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect API traffic and block malicious payloads targeting the vulnerable endpoint.

Public Exploit Available: No

Given the potential for complete database compromise and the high CVSS severity, organizations utilizing OpenSTAManager must prioritize this update. Administrators should verify the current version of their deployment and apply version 2.9.5 without delay to prevent exploitation by malicious actors.