OpenSTAManager Affected by XSS in modifica_iva.php via righe parameter
Date: 2026-03
Affected: composer/devcode-it/openstamanager
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-24415
CWE: CWE-79

### Summary Multiple Reflected Cross-Site Scripting (XSS) vulnerabilities in OpenSTAManager v2.9.8 allow unauthenticated attackers to execute arbitrary JavaScript code in the context of other users' browsers through crafted URL parameters, potentially leading to session hijacking, credential theft, and unauthorized actions. **Vulnerable Parameter:** `righe` (GET) ### Details OpenSTAManager v2.9.8 contains multiple Reflected XSS vulnerabilities in invoice/order/contract modification modals. The application fails to properly sanitize user-supplied input from the `righe` GET parameter before reflecting it in HTML output. **Vulnerable Code Location:** File: `/modules/contratti/modals/modifica_iva.php` (Line 125) ```php <input type="hidden" name="righe" value="<?php echo $_GET['righe']; ?>"> ``` The `$_GET['righe']` parameter is directly echoed into the HTML `value` attribute without any sanitization using `htmlspecialchars()` or equivalent functions. This allows an attacker to break out of the attribute context and inject arbitrary HTML/JavaScript. **All Affected Files:** 1. `/modules/contratti/modals/modifica_iva.php` - **Line 125, Line 167** 2. `/modules/preventivi/modals/modifica_iva.php` - **Line 125, Line 167** 3. `/modules/fatture/modals/modifica_iva.php` - **Line 121, Line 161** 4. `/modules/ddt/modals/modifica_iva.php` - **Line 125, Line 167** 5. `/modules/ordini/modals/modifica_iva.php` - **Line 125, Line 167** 6. `/modules/interventi/modals/modifica_iva.php` -


Mitigations:

Architectural layers (MAESTRO):