GHSA-w995-ff8h-rppg

Описание

Summary

A SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access.

Proof of Concept

Vulnerable Code

File: modules/anagrafiche/ajax/complete.php:28

Data Flow

1. Source: $_GET['idanagrafica'] → get('idanagrafica')
2. Vulnerable: User input concatenated directly into SQL query with single quotes
3. Sink: $dbo->fetchArray($q) executes the malicious query

Exploit

Manual PoC (Time-based Blind SQLi):

SQLMap Exploitation:

SQLMap Output:

Impact

• Data Exfiltration: Complete database extraction including user credentials, customer data, financial records
• Privilege Escalation: Modification of zz_users table to gain admin access
• Data Integrity: Unauthorized modification or deletion of records
• Potential RCE: Via SELECT ... INTO OUTFILE if file permissions allow

Affected Versions

• OpenSTAManager: Verified in latest version (as of December 2025)
• All versions using this endpoint are likely affected

Remediation

Replace direct concatenation with prepared statements:

Before:

After:

Credit

Discovered by: Łukasz Rybak