GitHub Security Advisory: GHSA-4hc4-8599-xh2h
Package: devcode-it/openstamanager (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 2.9.8
Patched in: unpatched

Summary: OpenSTAManager has a Time-Based Blind SQL Injection with Amplified Denial of Service

Details:
### Summary

Critical Time-Based Blind SQL Injection vulnerability affecting **multiple search modules** in OpenSTAManager v2.9.8 allows authenticated attackers to extract sensitive database contents including password hashes, customer data, and financial records through time-based Boolean inference attacks with **amplified execution** across 10+ modules.

**Status:** ✅ Confirmed and tested on live instance (v2.9.8)
**Vulnerable Parameter:** `term` (GET)
**Affected Endpoint:** `/ajax_search.php`
**Affected Modules:** Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, Contratti, Automezzi, Interventi

### Details

OpenSTAManager v2.9.8 contains a critical Time-Based Blind SQL Injection vulnerability in the global search functionality. The application fails to properly sanitize the `term` parameter before using it in SQL LIKE clauses across multiple module-specific search handlers, allowing attackers to inject arbitrary SQL commands and extract sensitive data through time-based Boolean inference.

**Vulnerability Chain:**

1. **Entry Point:** `/ajax_search.php` (Line 30-31)
   ```php
   $term = get('term');
   $term = str_replace('/', '\\/', $term);
   ```
   The `$term` parameter undergoes minimal sanitization (only forward slash replacement).

2. **Distribution:** `/src/AJAX.php::search()` (Line 159-161)
   ```php
   $files = self::find('ajax/search.php');
   array_unshift($files, base_dir().'/ajax_search.php');
   foreach ($files as $file) {
       $module_results = self::getSearchResults($file, $term);
   ```
   The unsanitized `$term` is passed to all module-specific search handlers.

3. **Execution:** `/src/AJAX.php::getSearchResults()` (Line 373)
   ```php
   require $file;
   ```
   Each module's search.php file is included with `$term` variable in scope.

4. **Vulnerable SQL Queries:** Multiple modules directly concatenate `$term` without `prepare()`

**All Affected Files (10+ vulnerable instances):**

1. **`/modules/articoli/ajax/search.php` - Line 51** (PRIMARY EXAMPLE)
   ```php
   foreach ($fields as $name => $value) {
       $query .= ' OR '.$value.' LIKE "%'.$term.'%"';
   }
   $rs = $dbo->fetchArray($query);
   ```
   **Impact:** Direct concatenation without `prepare()`, allows full SQL injection.

2. **`/modules/ordini/ajax/search.php` - Line 43, 47**
   ```php
   $query .= ' OR '.$value.' LIKE "%'.$term.'%"';
   $query .= '... WHERE `mg_articoli`.`codice` LIKE "%'.$term.'%" OR `mg_articoli_lang`.`title` LIKE "%'.$term.'%"';
   ```

3. **`/modules/ddt/ajax/search.php` - Line 43, 47**
   ```php
   $query .= ' OR '.$value.' LIKE "%'.$term.'%"';
   ```

4. **`/modules/fatture/ajax/search.php` - Line 45, 49**
   ```php
   $query .= ' OR '.$value.' LIKE "%'.$term.'%"';
   ```

5. **`/modules/preventivi/ajax/search.php` - Line 45, 49**
   ```php
   $query .= ' OR '.$value.' LIKE "%'.$term.'%"';
   ```

6. **`/modules/anagrafiche/ajax/search.php` - Line 62, 107, 162**
   ```php
   $query .= ' OR '.$value.' LIKE "%'.$term.'