A critical SQL injection vulnerability in OpenSTAManager allows authenticated attackers to extract sensitive database information, requiring an immediate update to version 2.10.2.

The application fails to properly sanitize the righe parameter in the confronta_righe.php file before including it in a database query. This vulnerability requires an authenticated attacker to trigger the malicious SQL injection.

Successful exploitation of this SQL injection vulnerability grants an attacker the ability to bypass application logic and exfiltrate sensitive data, such as customer records, invoicing details, and administrative credentials. Given the CVSS score of 8.8, this represents a high risk to data confidentiality and integrity, potentially leading to severe regulatory non-compliance and reputational damage.

Immediate Action: Update the OpenSTAManager installation to version 2.10.2 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review application access logs for unusual GET requests containing SQL syntax patterns or unexpected characters in the righe parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection attack signatures targeting the application backend.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the presence of a known proof-of-concept, necessitates an urgent response. Security teams must prioritize upgrading to version 2.10.2 to close the injection vector. If an immediate patch is not feasible, restrict access to the affected module and implement strict WAF filtering to mitigate the risk of unauthorized database access.