GHSA-4hc4-8599-xh2h OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service
SummaryCritical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules.**Status:** ✅ Confirmed and tested on live instance (v2.9.8)
**Vulnerable Parameter:** `term` (GET)
**Affected Endpoint:** `/ajax_search.php`
**Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, InterventiDetailsOpenSTAManager v2.9.8 contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.**Vulnerability Chain:****Entry Point:** `/ajax_search.php` (Line 30-31)The `$term` parameter undergoes minimal sanitization (only forward slash replacement).**Distribution:** `/src/AJAX.php::search()` (Line 159-161)The unsanitized `$term` is passed to all module-specific search handlers.**Execution:** `/src/AJAX.php::getSearchResults()` (Line 373)Each module's search.php file is included with `$term` variable in scope.**Vulnerable SQL Queries:** Multiple modules directly concatenate `$term` without `prepare()`**All Affected Files (10+ vulnerable instances):****`/modules/articoli/ajax/search.php` - Line 51** (PRIMARY EXAMPLE)**Impact:** Direct concatenation without `prepare()`, allows full SQL injection.**`/modules/ordini/ajax/search.php` - Line 43, 47****`/modules/ddt/ajax/search.php` - Line 43, 47****`/modules/fatture/ajax/search.php` - Line 45, 49****`/modules/preventivi/ajax/search.php` - Line 45, 49****`/modules/anagrafiche/ajax/search.php` - Line 62, 107, 162****`/modules/impianti/ajax/search.php` - Line 46****Properly Sanitized (NOT vulnerable):**`/modules/contratti/ajax/search.php` - Uses `prepare()` correctly`/modules/automezzi/ajax/search.php` - Uses `prepare()` correctly**Note:** The vulnerability has **amplified execution** - a single malicious request triggers SQL Injection across ALL vulnerable modules simultaneously, causing time-based attacks to execute 10+ times per request, multiplying the delay and leading to **504 Gateway Time-out** errors as observed on the live demo instance.PoC**Step 1: Login****Step 2: Verify Vulnerability (Time-Based SLEEP)****Step 3: Data Extraction - Database Name**Impact**Affected Users:** All authenticated users with access to the global search functionality.Complete database exfiltration including customer PII, financial records, business secretsExtraction of password hashes for offline crackingAmplified time-based attacks consume 85x server resources per request**Recommended Fix:**Replace all instances of direct `$term` concatenation with `prepare()`:**BEFORE (Vulnerable):****AFTER (Fixed):****Apply this fix to ALL affected files:**`/modules/articoli/ajax/search.php` - Line 51`/modules/ordini/ajax/search.php` - Lines 43, 47, 79`/modules/ddt/ajax/search.php` - Lines 43, 47, 83`/modules/fatture/ajax/search.php` - Lines 45, 49, 85`/modules/preventivi/ajax/search.php` - Lines 45, 49, 83`/modules/anagrafiche/ajax/search.php` - Lines 62, 107, 162`/modules/impianti/ajax/search.php` - Line 46
CVSS v4.0 score: 8.7