Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenSTAManager has an authenticated SQL Injection vulnerability in API via 'display' parameter
Vulnerability Description
OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.9.5, an authenticated SQL Injection vulnerability in the API allows any user, regardless of permission level, to execute arbitrary SQL queries. By manipulating the display parameter in an API request, an attacker can exfiltrate, modify, or delete any data in the database, leading to a full system compromise. This issue has been patched in version 2.9.5.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
OpenSTAManager SQL注入漏洞
Vulnerability Description
OpenSTAManager是Devcode开源的一个用于技术援助和计费的开源管理软件。 OpenSTAManager 2.9.5之前版本存在SQL注入漏洞，该漏洞源于API中存在SQL注入，可能导致任意用户通过操纵display参数执行任意SQL查询，泄露、修改或删除数据库数据。
CVSS Information
N/A
Vulnerability Type
N/A