CVE-2026-35470 is an SQL Injection vulnerability affecting OpenSTAManager before version 2.10.2. The issue exists in multiple modules where the 'righe' parameter is taken from $_GET and concatenated directly into SQL queries without any input sanitization, parameterization, or validation. This improper neutralization of special elements (CWE-89) allows an authenticated attacker to inject arbitrary SQL statements. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality, integrity, and availability. The vulnerability is fixed in OpenSTAManager 2.10.2.

Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands on the database, leading to unauthorized disclosure of sensitive information including user credentials, customer data, and invoice records. It also allows modification or deletion of data, impacting confidentiality, integrity, and availability of the system.

Upgrade OpenSTAManager to version 2.10.2 or later, where this SQL Injection vulnerability is fixed. Since no official patch or remediation level is explicitly stated beyond the version fix, applying this update is the recommended action. Patch status is not yet confirmed beyond the version fix note; verify with the vendor advisory for current remediation guidance.