OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419

Metadata

Affected Target

Summary

The Prima Nota (journal entry) module’s add.php reads the id_documenti GET parameter, splits it on commas with explode(), but never validates that the resulting elements are integers before imploding them back into a SQL IN() clause used to look up idanagrafica from co_documenti. An authenticated attacker can supply a crafted value such as 1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT ...)))# to break out of the intended numeric context and trigger an XPATH syntax error whose message discloses the result of an arbitrary subquery — for example the database user and version. This is a classic error-based SQL injection that requires no time-based inference, making extraction fast and reliable.

Vulnerability Details

Root Cause

/modules/primanota/add.php (lines ~63-67) retrieves id_documenti via get() and calls explode(',', (string) $id_documenti) without validating that elements are integers; line ~306 then implode()s the array directly into a SQL IN() clause without using prepare(), allowing injected SQL to reach the query.

Attack Vector

1. Authenticate to OpenSTAManager with any valid user account.
2. Send a GET request to /modules/primanota/add.php with id_documenti=1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT CONCAT(USER(),' | ',VERSION()))))#.
3. Read the resulting XPATH syntax error in the HTTP response, which embeds the subquery result (e.g. ~osm@172.18.0.3 | 8.3.0).
4. Substitute arbitrary subqueries (e.g. against zz_users) and chunk long results with SUBSTRING() to exfiltrate credentials and other sensitive data.

Impact

Direct, low-effort extraction of database contents (user credentials, customer PII, financial records) by any authenticated user via a single crafted request per data point.

Environment / Lab Setup

Target:   OpenSTAManager <= 2.9.8 (PHP/MySQL), e.g. http://localhost:8081
Attacker: curl

Proof of Concept

PoC Script

See poc_primanota_sqli.sh in this folder.

1

./poc_primanota_sqli.sh http://localhost:8081 admin admin

The script logs in and sends a single GET request with an EXTRACTVALUE()-based payload in id_documenti, printing the resulting XPATH error that discloses the database user and version.

Detection & Indicators of Compromise

GET /modules/primanota/add.php?id_documenti=1)%20AND%20EXTRACTVALUE(...)%23
SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~<leaked data>'

Signs of compromise:

• Requests to /modules/primanota/add.php with id_documenti values containing ), AND, EXTRACTVALUE(/UPDATEXML( rather than plain comma-separated integers.
• Repeated near-identical requests differing only in SUBSTRING() offsets (indicates scripted data extraction).
• MySQL error logs showing XPATH syntax errors correlated with Prima Nota module access.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-24419 on 2026-07-05.