CVE-2025-69214: 
PHP vulnerability analysis and mitigation

CVE-2025-69214 is a time-based blind SQL injection vulnerability in OpenSTAManager, an open-source management software for technical assistance and invoicing. It affects all versions up to and including 2.9.8, residing in the ajax_select.php endpoint when handling the componenti operation. The vulnerability was discovered by Łukasz Rybak and disclosed on February 6, 2026 via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, OSM Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically in modules/impianti/ajax/select.php at lines 122–124. User-supplied input from $_GET['options']['matricola'] is passed to $superselect['matricola'] and concatenated directly into an SQL IN() clause without sanitization or parameterization: $where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')';. An authenticated attacker with low privileges can inject a time-based blind SQL payload through the options[matricola] GET parameter, causing the MySQL backend to execute arbitrary SQL via delayed responses. No special configuration or elevated privileges beyond a valid session are required (GitHub Advisory, OSM Advisory).

Successful exploitation allows an authenticated attacker to perform complete database extraction via time-based blind SQL injection, exposing sensitive business data including component and equipment records managed by OpenSTAManager. Integrity is also at risk, as attackers may be able to modify database records without authorization. The vulnerability's high confidentiality, integrity, and availability impact ratings reflect the potential for full database compromise within the affected system's scope (GitHub Advisory).

Public proof-of-concept exploit code is included in the GitHub Security Advisory, demonstrating both a manual time-based blind SQLi payload and automated exploitation using SQLMap. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.019% (6th percentile), indicating a currently low probability of near-term exploitation. No specific threat actor attribution has been reported (GitHub Advisory, OSM Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible OpenSTAManager instances running version 2.9.8 or earlier using search engines, Shodan, or internal network scanning.
2. Obtain authentication: Acquire valid low-privilege credentials for the OpenSTAManager application (e.g., a standard user account).
3. Establish session: Log in to the application and capture the PHPSESSID session cookie from the browser or proxy tool (e.g., Burp Suite).
4. Craft malicious request: Send a GET request to the vulnerable endpoint with a time-based blind SQL payload in the options[matricola] parameter:

   GET /ajax_select.php?op=componenti&options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1
   Host: <target>
   Cookie: PHPSESSID=<session_token>

5. Confirm vulnerability: Observe a ~5-second delay in the server response, confirming the SQL injection is successful.
6. Automate extraction: Use SQLMap to enumerate and dump the full database:

   sqlmap -u 'http://<target>/ajax_select.php?op=componenti&options[matricola]=1*' \
     --cookie="PHPSESSID=<session_token>" \
     --dbms=MySQL \
     --technique=T \
     --level=3 \
     --risk=3

7. Exfiltrate data: Extract tables, credentials, and business records from the MySQL database using SQLMap's --dump or --dump-all options (GitHub Advisory, OSM Advisory).

• Network: Unusual or repeated GET requests to /ajax_select.php with op=componenti and options[matricola] parameters containing SQL syntax (e.g., SLEEP, SELECT, AND, parentheses, --).
• Network: Abnormally slow HTTP responses (e.g., 5+ second delays) from the ajax_select.php endpoint, indicative of time-based blind SQL injection probing.
• Logs: Web server access logs showing requests to /ajax_select.php?op=componenti&options[matricola]= with URL-encoded SQL payloads from a single authenticated session.
• Logs: Database slow query logs recording repeated SLEEP() or time-delay function calls originating from the OpenSTAManager application user.
• Process: Unexpected database queries involving SLEEP(), BENCHMARK(), or nested SELECT statements in MySQL general query logs tied to the application's DB connection (GitHub Advisory).

As of the advisory publication date (February 6, 2026), no patched version has been officially released — the advisory lists "None" under patched versions. The recommended remediation is to cast the options[matricola] input to integers before use in the SQL query, replacing direct string concatenation with array_map('intval', explode(',', $impianti)) in modules/impianti/ajax/select.php. As interim workarounds, administrators should implement network-level access controls to restrict access to the ajax_select.php endpoint, enforce the principle of least privilege for application accounts, and monitor database activity for suspicious SQL patterns. Users should monitor the OSM Advisory for patch availability and apply updates as soon as they are released.

The vulnerability was reported by security researcher Łukasz Rybak and published via GitHub's security advisory process on February 6, 2026. Coverage appeared on threat intelligence aggregators and security news outlets including The Hacker Wire and Infinit Security shortly after disclosure. Social media activity was observed on Bluesky via The Hacker Wire's account. No major vendor statements beyond the advisory itself have been identified (OSM Advisory).