OpenSTAManager affected by reflected XSS in modifica_iva.php via righe parameter

Vulnerability

Description

OpenSTAManager versions 2.9.8 and earlier contain multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in the modification modals for invoices, orders, contracts, and other documents [1][3]. The root cause is improper sanitization of user-supplied input from the righe GET parameter, which is directly echoed into the HTML value attribute of hidden input fields without using htmlspecialchars() or equivalent functions [3]. This allows an attacker to break out of the attribute context and inject arbitrary HTML or JavaScript.

Exploitation

Attackers can exploit this vulnerability by crafting a malicious URL that includes a payload in the righe parameter, such as ?righe="> [3]. The attack requires no authentication and can be delivered via social engineering, such as tricking a user into clicking a crafted link while logged into the application [1][3]. The vulnerable code appears in at least six modal files, including /modules/contratti/modals/modifica_iva.php, /modules/fatture/modals/modifica_iva.php, and /modules/ordini/modals/modifica_iva.php [3].

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the victim's browser [3]. This can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of the user, potentially compromising sensitive data and enabling further attacks within the application [3].

Mitigation

As of the advisory, the vulnerability affects OpenSTAManager v2.9.8 and earlier. Users are advised to update to a patched version when available, or to apply input sanitization to the righe parameter in all affected modal files [3].