OpenSTAManager has an SQL Injection in Scadenzario Print Template

Vulnerability

Overview

An authenticated SQL injection vulnerability exists in OpenSTAManager versions 2.9.8 and earlier within the Scadenzario (Payment Schedule) print template. The flaw resides in templates/scadenzario/init.php, where the id_anagrafica parameter from GET/POST requests is directly concatenated into an SQL query without sanitization [1][3]. This allows any authenticated user to manipulate the query via error-based SQL injection.

Exploitation

The vulnerable endpoint is /pdfgen.php?ptype=scadenzario&id_anagrafica=[payload]. An attacker with a valid session can inject SQL commands through the id_anagrafica parameter. The application's get() function does not sanitize input, and the code fails to use the prepare() function for safe query construction [3]. A proof-of-concept shows that even a basic syntax error test can confirm injection, and error-based techniques can be used to extract database version and other data [3].

Impact

Successful exploitation grants complete read access to the underlying MySQL database. An attacker can extract admin credentials, customer information, and financial records, compromising the entire application's confidentiality [2][3].

Mitigation

As of the publication date, no official patch has been released. Users should upgrade to a patched version if one becomes available, or apply input validation and parameterized queries as a workaround. The vulnerability affects all authenticated users, regardless of role.