CVE-2025-69216 - CVE House
Back to Database
Status published High CVE-2025-69216

OpenSTAManager has an SQL Injection in Scadenzario Print Template

Vulnerability Description

OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template allows any authenticated user to extract sensitive data from the database, including admin credentials, customer information, and financial records. The vulnerability exists in templates/scadenzario/init.php, where the id_anagrafica parameter is directly concatenated into an SQL query without proper sanitization. The vulnerability enables complete database read access through error-based SQL injection techniques.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69216

Credits & Attribution

No credits recorded in the NVD database.

References

More from devcode-it

View All →
CVE-2025-69215
OpenSTAManager has an SQL Injection in the Stampe Module
High 8.7
CVE-2025-69214
OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
High 8.7
CVE-2025-69213
OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)
High 8.7
CVE-2025-69212
OpenSTAManager has an OS Command Injection in P7M File Processing
Critical 9.4
CVE-2025-65103
OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter
High 8.8

Affected Vendor

Affected Software

openstamanager
Vulnerable Versions:
<= 2.9.8

Timeline

Official Publish: February 6th, 2026
Last Modified: February 9th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact