OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417

Metadata

Affected Target

Summary

OpenSTAManager’s global search AJAX endpoint (/ajax_search.php) dispatches the user-supplied term parameter to more than ten module-specific search handlers (Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, and others), each of which concatenates term directly into a SQL LIKE clause without using the framework’s prepare() sanitizer. Because a single request fans out across all vulnerable modules, an injected time-based payload executes repeatedly in one HTTP call, multiplying the delay far beyond a normal single-injection point — turning what would be a blind SQLi into both a data-exfiltration primitive and a resource-exhaustion / denial-of-service vector. The PoC demonstrates the amplified timing effect and boolean-based data extraction from the DATABASE() function.

Vulnerability Details

Root Cause

The term GET parameter is minimally sanitized (only forward-slash escaping) in /ajax_search.php before being passed unchanged to at least seven module search handlers that build SQL LIKE clauses via string concatenation instead of prepare().

Attack Vector

1. Authenticate to the OpenSTAManager instance with any valid account.
2. Send a GET request to /ajax_search.php?term=... containing a boolean/time-based SQL payload appended to a closing quote (e.g. " AND 0 OR SLEEP(1) OR ").
3. Because the payload is injected identically into ~10 module queries, the SLEEP executes repeatedly per request, amplifying the observable delay (tests showed ~72s for a single-second SLEEP payload).
4. Use the amplified timing channel with SUBSTRING(DATABASE(),N,1) comparisons to blind-extract database contents.

Impact

Full database exfiltration (credentials, PII, financial data) plus a request-amplification denial-of-service effect that can exhaust server resources with disproportionately expensive single requests (504 Gateway Timeout observed on the live demo instance).

Environment / Lab Setup

Target:   OpenSTAManager < 2.9.8 (PHP/MySQL), e.g. http://localhost:8081
Attacker: curl

Proof of Concept

PoC Script

See poc_search_sqli.sh in this folder.

1

./poc_search_sqli.sh http://localhost:8081 admin admin

The script logs in, sends a SLEEP(1) payload via the term parameter to /ajax_search.php and times the amplified response, sends a SLEEP(0) baseline for comparison, and finally issues a boolean data-extraction probe against DATABASE().

Detection & Indicators of Compromise

GET /ajax_search.php?term=%22%20AND%200%20OR%20SLEEP(...)%20OR%20%22 ... response time >> baseline (amplified across modules)

Signs of compromise:

• A handful of requests to ajax_search.php each taking many multiples of normal response time (amplification signature, unlike a single-module SQLi).
• Elevated database CPU/thread count correlated with individual authenticated sessions hitting the search endpoint.
• SQL function names (SLEEP, SUBSTRING, DATABASE) present in decoded term parameter values in logs.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-24417 on 2026-07-05.