OpenSTAManager has an SQL Injection in the Stampe Module

Vulnerability

Overview

CVE-2025-69215 describes a SQL injection vulnerability in the Stampe module stampe/actions.php of OpenSTAManager, an open-source management software for technical assistance and invoicing [2]. The flaw exists in the update case handler, where the module parameter from POST data is directly concatenated into an SQL UPDATE query without proper sanitization [1]. While the predefined parameter is validated with intval(), the modulemodule only an !empty() is applied to module`, which does not prevent injection [1].

Exploitation

An authenticated attacker can exploit this by sending a crafted POST request to /modules/stampe/actions.php with op=update, a non-zero predefined value, and a malicious module parameter [1]. The provided reference demonstrates error-based SQL injection using MySQL functions such as EXTRACTVERSION(), DATABASE(), and USER() via EXTRACTVALUE, UPDATEXML, or GTID_SUBSET [1]. No authentication bypass is needed; the attacker must have valid credentials to the application.

Impact

Successful exploitation allows an attacker to extract sensitive information from the database, including user credentials, business data, and other records managed by the application [2]. The vulnerability could lead to full compromise of the application's data integrity and confidentiality.

Mitigation

At the time of publication, no patch is available for this vulnerability [3]. Users are advised to apply input sanitization to the module parameter or restrict access to the affected module until a fix is released.