CVE-2025-69213 - CVE House
Back to Database
Status published High CVE-2025-69213

OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)

Vulnerability Description

OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69213

Credits & Attribution

No credits recorded in the NVD database.

References

More from devcode-it

View All →
CVE-2025-69216
OpenSTAManager has an SQL Injection in Scadenzario Print Template
High 8.7
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
High 8.7
CVE-2025-69214
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
High 8.7
CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
Critical 9.4
CVE-2025-65103
OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter
High 8.8

Affected Vendor

Affected Software

openstamanager
Vulnerable Versions:
<= 2.9.8

Timeline

Official Publish: February 4th, 2026
Last Modified: February 4th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact