OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)

Metadata

Affected Target

Summary

OpenSTAManager fails to sanitize the righe GET parameter before reflecting it into a hidden HTML input’s value attribute across six modifica_iva.php modal files (contracts, quotes, invoices, DDT, orders, and interventions modules). Because the parameter is echoed with a raw echo $_GET['righe']; instead of htmlspecialchars(), an attacker can break out of the attribute context and inject arbitrary HTML/JavaScript. Sending a crafted link to an authenticated user results in JavaScript execution in that user’s session, as demonstrated by the repository’s tested payloads on a live demo instance and confirmed via alert(document.cookie).

Vulnerability Details

Root Cause

CWE-79 (Improper Neutralization of Input During Web Page Generation): $_GET['righe'] is echoed directly into an HTML attribute without htmlspecialchars() or equivalent encoding in /modules/*/modals/modifica_iva.php across six modules.

Attack Vector

1. Attacker crafts a URL to any of the six vulnerable modifica_iva.php endpoints with righe="><script>...</script> as the payload.
2. Attacker delivers the link to a victim via email, chat, or another social channel.
3. The authenticated victim clicks the link while logged into OpenSTAManager.
4. The unsanitized righe value breaks out of the value="" attribute, and the injected <script> executes in the victim’s browser in the application’s origin.
5. The attacker’s script can exfiltrate session cookies, perform actions as the victim, steal CSRF tokens, or redirect to a phishing page.

Impact

Reflected XSS enabling session cookie theft and full account takeover, unauthorized record creation/modification/deletion, CSRF token theft, and phishing redirection for any authenticated OpenSTAManager user who clicks a crafted link.

Environment / Lab Setup

Target:   OpenSTAManager < 2.9.8 (tested against v2.9.8 demo instance and localhost:8081 test instance)
Attacker: curl or any browser; no special tooling required beyond crafting the URL payload

Proof of Concept

PoC Script

See poc.sh in this folder.

1

./poc.sh http://localhost:8081 admin admin

The script authenticates to the target instance and then prints the six crafted modifica_iva.php URLs (one per affected module) carrying the righe="><script>alert(document.cookie)</script> payload; opening any of them in an authenticated browser session triggers a JavaScript alert displaying the session cookie, confirming the reflected XSS.

Detection & Indicators of Compromise

GET /modules/contratti/modals/modifica_iva.php?righe=%22%3E%3Cscript%3E...

Signs of compromise:

• Access log entries with <script>, onerror=, or javascript: patterns in the righe query parameter
• Unexpected outbound requests from victim browsers to attacker-controlled domains following a clicked link
• Reports of unauthorized account actions or session hijacking correlated with a shared/clicked link

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-24415 on 2026-07-05.