OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint ($skip_permissions = true). It loads a record from the zz_oauth2 table using the attacker-controlled GET parameter state, and during the OAuth2 configuration flow calls unserialize() on the access_token field without any class restriction. This issue has been patched in version 2.10.2.

Affected: Packagist: devcode-it/openstamanager

## Description

The `oauth2.php` file in OpenSTAManager is an **unauthenticated** endpoint (`$skip_permissions = true`). It loads a record from the `zz_oauth2` table using the attacker-controlled GET parameter `state`, and during the OAuth2 configuration flow calls `unserialize()` on the `access_token` field **without any class restriction**.

An attacker who can write to the `zz_oauth2` table (e.g., via the arbitrary SQL injection in the Aggiornamenti module reported in [GHSA-2fr7-cc4f-wh98](https://github.com/devcode-it/openstamanager/security/advisories/GHSA-2fr7-cc4f-wh98)) can insert a malicious serialized PHP object (gadget chain) that upon deserialization executes arbitrary commands on the server as the `www-data` user.

## Affected code

### Entry point — `oauth2.php`

```php $skip_permissions = true; // Line 23: NO AUTHENTICATION include_once __DIR__.'/core.php';

$state = $_GET['state']; // Line 28: attacker-controlled $code = $_GET['code'];

$account = OAuth2::where('state', '=', $state)->first(); // Line 33: fetches injected record $response = $account->configure($code, $state); // Line 51: triggers the chain ```

### Deserialization — `src/Models/OAuth2.php`

```php // Line 193 (checkTokens): $access_token = $this->access_token ? unserialize($this->access_token) : null;

// Line 151 (getAccessToken): return $this->attributes['access_token'] ? unserialize($this->attributes['access_token']) : null…