OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.

Affected: Packagist: devcode-it/openstamanager

## Summary A critical OS Command Injection vulnerability exists in the P7M (signed XML) file decoding functionality. An authenticated attacker can upload a ZIP file containing a .p7m file with a malicious filename to execute arbitrary system commands on the server.

## Vulnerable Code **File:** `src/Util/XML.php:100`

```php public static function decodeP7M($file) { $directory = pathinfo($file, PATHINFO_DIRNAME); $content = file_get_contents($file);

$output_file = $directory.'/'.basename($file, '.p7m');

try { if (function_exists('exec')) { // VULNERABLE - No input sanitization! exec('openssl smime -verify -noverify -in "'.$file.'" -inform DER -out "'.$output_file.'"', $output, $cmd); ```

**The Problem:** - The `$file` parameter is passed directly into `exec()` without sanitization - Although wrapped in double quotes, an attacker can escape them - The filename comes from uploaded ZIP archives (user-controlled)

## Attack Vector

### Entry Points: 1. **plugins/importFE_ZIP/actions.php:126** (when automatic import is enabled) ```php foreach ($files_xml as $xml) { if (string_ends_with($xml, '.p7m')) { $file = XML::decodeP7M($directory.'/'.$xml); // $xml from ZIP! ```

2. **plugins/importFE/src/FatturaElettronica.php:56** (constructor) ```php if (string_ends_with($name, '.p7m')) { $file = XML::decodeP7M($this->file); // $name from user input! ```

### Attack Flow: 1. Attacker creates…