CVE-2025-65103: 
PHP 脆弱性の分析と軽減

OpenSTAManager contains an authenticated SQL Injection vulnerability (CVE-2025-65103) in its API through the 'display' parameter. The vulnerability was discovered and disclosed on November 19, 2025, affecting versions 2.9.4 and earlier, with version 2.9.5 providing the patch. This security flaw allows any authenticated user, regardless of their permission level, to execute arbitrary SQL queries against the system's database (GitHub Advisory, Miggo Database).

The vulnerability exists in the retrieve() method within src/API/Manager.php, where user input from the display GET parameter is processed without proper validation. The code strips surrounding brackets [], splits the string by commas, and passes each resulting element directly into the selectRaw() function of the query builder without sanitization. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

The vulnerability allows authenticated attackers to exfiltrate all data from the database, including user credentials, customer information, invoices, and internal data. Additionally, attackers can modify or delete data, compromising data integrity, and potentially achieve further system compromise depending on the database user's privileges and system configuration (GitHub Advisory).

Users should upgrade to OpenSTAManager version 2.9.5 or later, which contains the patch for this vulnerability (GitHub Advisory).