CVE-2025-65103: 
PHP vulnerability analysis and mitigation

OpenSTAManager, an open source management software for technical assistance and invoicing, was found to contain an authenticated SQL Injection vulnerability (CVE-2025-65103) in its API prior to version 2.9.5. The vulnerability was disclosed on November 19, 2025, affecting all versions up to and including 2.9.4. This security flaw allows any authenticated user, regardless of permission level, to execute arbitrary SQL queries through the API (GitHub Advisory, NVD).

The vulnerability exists in the retrieve() method within src/API/Manager.php, where user input from the 'display' GET parameter is processed without proper validation. The code strips surrounding brackets [], splits the string by commas, and passes each resulting element directly into the selectRaw() function of the query builder. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command (GitHub Advisory).

The vulnerability allows authenticated attackers to exfiltrate all data from the database, including user credentials, customer information, invoices, and internal data. Additionally, attackers can modify or delete data, compromising data integrity, and potentially achieve further system compromise depending on the database user's privileges and system configuration (GitHub Advisory).

The vulnerability has been patched in OpenSTAManager version 2.9.5. Users are advised to upgrade to this version or later to protect against this security issue (GitHub Advisory).