OpenSTAManager has an SQL Injection in the Prima Nota module

Vulnerability

Overview

OpenSTAManager v2.9.8 and earlier contain a critical error-based SQL injection vulnerability in the Prima Nota (Journal Entry) module's add.php file [2]. The application fails to validate that comma-separated values from the id_documenti GET parameter are integers before using them in SQL IN() clauses, allowing attackers to inject arbitrary SQL commands [3].

Exploitation

Details

An authenticated attacker can exploit this vulnerability by crafting a malicious id_documenti parameter in the URL to /modules/primanota/add.php. The injected SQL is executed and error messages, specifically XPATH errors, are used to extract sensitive information from the database [3]. No additional privileges beyond authentication are required.

Impact

Successful exploitation enables an attacker to extract the entire database contents, including user credentials, customer personally identifiable information (PII), and financial records [3]. This could lead to account takeover, data breaches, and financial fraud.

Mitigation

As of the advisory, no patch has been released for the vulnerable versions [3]. Users are advised to implement strict input validation on the id_documenti parameter or restrict access to the Prima Nota module until a fix is available.