CVE-2026-24416
BaseFortify
Publication date: 2026-02-06
Last updated on: 2026-02-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| devcode | openstamanager | to 2.9.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to modify the vulnerable SQL query to use prepared statements for the `idarticolo` parameter, ensuring proper sanitization.'}, {'type': 'paragraph', 'content': 'Specifically, change the query from concatenating the `idarticolo` parameter directly into the SQL string to using a prepared statement function, for example:'}, {'type': 'list_item', 'content': "Replace `WHERE idarticolo = ' . $idarticolo . '` with `WHERE idarticolo = ' . prepare($idarticolo) . '`"}, {'type': 'paragraph', 'content': 'This fix aligns the handling of `idarticolo` with other parameters like `idanagrafica` that are already sanitized.'}, {'type': 'paragraph', 'content': 'Additionally, restrict access to the article pricing functionality to trusted authenticated users and monitor for suspicious activity involving the vulnerable endpoint.'}] [1]
Can you explain this vulnerability to me?
CVE-2026-24416 is a critical Time-Based Blind SQL Injection vulnerability found in OpenSTAManager versions up to and including v2.9.8. It exists in the article pricing module, specifically in the handling of the idarticolo parameter within a SQL query.
The vulnerability occurs because the idarticolo parameter is directly concatenated into a SQL query without proper sanitization or use of prepared statements, unlike other parameters. This improper handling allows attackers to inject arbitrary SQL commands.
Attackers can exploit this flaw by sending specially crafted requests that cause the database to delay responses based on injected conditions (using functions like SLEEP()). By measuring these delays, attackers can infer sensitive data from the database, such as user credentials, customer data, and financial records.
Exploitation requires authentication but has low complexity and can be performed remotely. The recommended fix is to modify the vulnerable SQL query to use prepared statements for the idarticolo parameter to prevent injection.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized disclosure of sensitive data such as user credentials, customer information, and financial records.
Because it is a time-based blind SQL injection, attackers can extract complete database contents by inferring data through response delays.
The vulnerability allows attackers with low privileges (authenticated users) to perform remote attacks without user interaction, potentially compromising confidentiality, integrity, and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the vulnerable endpoint for time-based blind SQL injection using the idarticolo GET parameter.'}, {'type': 'paragraph', 'content': 'Specifically, sending requests to the affected endpoint `/modules/articoli/ajax/complete.php?op=getprezzi` with crafted payloads in the `idarticolo` parameter that cause measurable delays can confirm the presence of the vulnerability.'}, {'type': 'list_item', 'content': "Example test payload to detect the vulnerability: `idarticolo=1 AND SUBSTRING(DATABASE(),1,1)='o' AND (SELECT 1 FROM (SELECT(SLEEP(2)))a)`"}, {'type': 'paragraph', 'content': 'By measuring response delays after sending such requests, you can infer if the SQL injection is exploitable.'}, {'type': 'paragraph', 'content': 'An automated approach involves using scripts that iterate over characters and measure response times to extract data via time-based inference.'}] [1]