CVE-2025-65103 - CVE House
Back to Database
Status published High CVE-2025-65103

OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter

Vulnerability Description

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65103

Credits & Attribution

No credits recorded in the NVD database.

References

More from devcode-it

View All →
CVE-2025-69216
OpenSTAManager has an SQL Injection in Scadenzario Print Template
High 8.7
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
High 8.7
CVE-2025-69214
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
High 8.7
CVE-2025-69213
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
High 8.7
CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
Critical 9.4

Affected Vendor

Affected Software

openstamanager
Vulnerable Versions:
< 2.9.5

Timeline

Official Publish: November 19th, 2025
Last Modified: November 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact