OpenSTAManager has an OS Command Injection in P7M File Processing

Vulnerability

OpenSTAManager versions 2.9.8 and earlier are affected by a critical OS command injection vulnerability in the P7M (signed XML) file decoding functionality. The decodeP7M() method in src/Util/XML.php (line 100) passes user-supplied file paths directly into an exec() call without adequate sanitization. Although the filename is wrapped in double quotes, an attacker can escape them by including shell meta-characters in the filename. The vulnerable code is reachable through the importFE_ZIP plugin and the FatturaElettronica constructor, both of which process filenames from uploaded ZIP archives. [3]

Attack

Vector The attacker must be authenticated and upload a specially crafted ZIP archive. PHP's ZipArchive::extractTo() splits filenames on the / character, so the payload must not contain / in commands. The import flow extracts the ZIP, iterates over .p7m files, and calls decodeP7M() with the extracted filename. By embedding command injection sequences (e.g., backticks or ;) in the filename, an attacker can execute arbitrary system commands on the server running the web server user context. [3]

Impact

Successful exploitation grants the attacker the ability to execute arbitrary OS commands, leading to complete compromise of the application server. Given the sensitive data managed by OpenSTAManager (customer records, invoices, warehouse management), an attacker could exfiltrate data, modify records, or pivot to internal networks. The vulnerability is rated critical but CVSS 4.0 metrics have not yet been assigned by NVD. [2][3]

Mitigation

The vulnerability affects all versions up to and including 2.9.8. The vendor has not yet released a patched version as of the publication date. Users should restrict access to the import functionality, monitor for unusual ZIP uploads, and disable automatic import if not required. The advisory recommends treating filenames from ZIP archives as untrusted and applying strict input validation before use in shell commands. [1][3]