https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:50:57 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274291 EUVD-2026-274291 https://cve.radiocsirt.org/vuln/euvd-2026-274291 https://cve.radiocsirt.org/vuln/fkie_cve-2026-27012 <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user&#39;s group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.</p> <p>OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user&#39;s group (idgruppo) by directly calling modules/utenti/actions.php. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-27012 https://cve.radiocsirt.org/vuln/ghsa-247v-7cw6-q57v <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>### Summary A privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user&#39;s group (`idgruppo`) by directly calling `modules/utenti/actions.php`. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.</p> <p>### Details `modules/utenti/actions.php` is reachable directly via `http://&lt;IP&gt;:8080/modules/utenti/actions.php` and processes privileged information without requiring any authentication or authorization checks on fields like idgruppo. As a result, an attacker can submit a crafted POST request that updates the targets record and assigns it to the administrator group.</p> <p>The file explicitly sets: ```PHP $skip_permissions = true; include_once __DIR__.&#39;/../../core.php&#39;; ``` `core.php` then invokes:</p> <p>```PHP Permissions::skip(); ``` Thus, disabling any authentication and permission enforcement. As a result, this file processes operations based on the `op` parameter in the POST request, not only `update_user`. Sensitive fields like `idgruppo` and others can be updated without verifying anything.</p> <p>### PoC A target username exists, such as &#34;agent&#34; with an ID of 4. No authentication or cookies are required. Send the following POST request via Burp Suite or similar: &lt;img width=&#34;1094&#34; height=&#34;255&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/2e8cb148-1b5d-4e5c-9c73-05ed75d64188&#34; /&gt; The target&#39;s group is updated in the datab…</p> <p><strong>Affected:</strong> Packagist: devcode-it/openstamanager</p> <p>### Summary A privilege escalation and authentication bypass vulnerability in OpenSTAManager allows any attacker to arbitrarily change a user&#39;s group (`idgruppo`) by directly calling `modules/utenti/actions.php`. This can promote an existing account (e.g. agent) into the Amministratori group as well as demote any user including existing administrators.</p> <p>### Details `modules/utenti/actions.php` is reachable directly via `http://&lt;IP&gt;:8080/modules/utenti/actions.php` and processes privileged information without requiring any authentication or authorization checks on fields like idgruppo. As a result, an attacker can submit a crafted POST request that updates the targets record and assigns it to the administrator group.</p> <p>The file explicitly sets: ```PHP $skip_permissions = true; include_once __DIR__.&#39;/../../core.php&#39;; ``` `core.php` then invokes:</p> <p>```PHP Permissions::skip(); ``` Thus, disabling any authentication and permission enforcement. As a result, this file processes operations based on the `op` parameter in the POST request, not only `update_user`. Sensitive fields like `idgruppo` and others can be updated without verifying anything.</p> <p>### PoC A target username exists, such as &#34;agent&#34; with an ID of 4. No authentication or cookies are required. Send the following POST request via Burp Suite or similar: &lt;img width=&#34;1094&#34; height=&#34;255&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/2e8cb148-1b5d-4e5c-9c73-05ed75d64188&#34; /&gt; The target&#39;s group is updated in the datab…</p> https://cve.radiocsirt.org/vuln/ghsa-247v-7cw6-q57v