CVE-2026-28805 Devcode CVE debrief

Who should care

System administrators and security teams responsible for OpenSTAManager installations should assess exposure and prioritize patching to prevent potential data breaches. They should also verify database exposure and sensitive data storage, and monitor for suspicious SQL injection attempts.

Why it matters

CVE-2026-28805 is a high-severity vulnerability in OpenSTAManager that allows authenticated attackers to inject arbitrary SQL statements, potentially leading to data breaches and exposure of sensitive information. System administrators and security teams should prioritize patching to version 2.10.2 or later and verify database exposure.

• Potential data breaches through SQL injection
• Exposure of sensitive data, including usernames and password hashes
• Possible financial losses due to unauthorized access

Technical summary

The vulnerability exists in multiple AJAX select handlers in OpenSTAManager, specifically through the options[stato] GET parameter. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and other information stored in the MySQL database. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation.

Defensive priority

High priority for patching and verifying database exposure

Recommended defensive actions

• Patch OpenSTAManager to version 2.10.2 or later
• Verify database exposure and sensitive data storage
• Monitor for suspicious SQL injection attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in multiple AJAX select handlers in OpenSTAManager, specifically through the options[stato] GET parameter. The user-supplied value is concatenated directly into SQL WHERE clauses without sanitization or parameterization. This issue allows attackers to inject arbitrary SQL statements, potentially leading to data breaches and exposure of sensitive information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.