OpenSTAManager has an SQL Injection in the Stampe Module
Date: 2026-02
Affected: composer/devcode-it/openstamanager
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-69215
CWE: CWE-89

## Vulnerability Details ### Location - **File:** `modules/stampe/actions.php` - **Line:** 26 - **Vulnerable Code:** ```php case 'update': if (!empty(intval(post('predefined'))) && !empty(post('module'))) { $dbo->query('UPDATE `zz_prints` SET `predefined` = 0 WHERE `id_module` = '.post('module')); // ↑ Direct concatenation without prepare() sanitization } ``` ### Root Cause The `module` parameter from POST data is directly concatenated into an SQL UPDATE query without using the `prepare()` sanitization function. While the `predefined` parameter is validated with `intval()`, the `module` parameter only has an `!empty()` check, which does NOT prevent SQL injection. **Vulnerable Pattern:** ```php // Line 25: intval() protects predefined, but module is not sanitized! if (!empty(intval(post('predefined'))) && !empty(post('module'))) { // Line 26: Direct concatenation - VULNERABLE $dbo->query('UPDATE ... WHERE `id_module` = '.post('module')); } ``` ## Exploitation ### Vulnerable Endpoint ``` POST /modules/stampe/actions.php ``` ### Required Parameters ``` op=update id_record=1 predefined=1 (must be non-zero after intval()) module=[INJECTION_PAYLOAD] title=Test filename=test.pdf ``` ### Authentication Requirement - Requires valid authenticated session (any user with access to Stampe module) - **VERIFIED:** Users with "Tecnici" group access can exploit (NOT admin-only!) - **PoC:** Demo at https://demo.osmbusiness.it with credentials tecnico/tecn


Mitigations:

Architectural layers (MAESTRO):