OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability in the Stampe Module. At time of publication, no known patch exists.

Affected: Packagist: devcode-it/openstamanager

## Vulnerability Details

### Location - **File:** `modules/stampe/actions.php` - **Line:** 26 - **Vulnerable Code:** ```php case 'update': if (!empty(intval(post('predefined'))) && !empty(post('module'))) { $dbo->query('UPDATE `zz_prints` SET `predefined` = 0 WHERE `id_module` = '.post('module')); // ↑ Direct concatenation without prepare() sanitization } ```

### Root Cause

The `module` parameter from POST data is directly concatenated into an SQL UPDATE query without using the `prepare()` sanitization function. While the `predefined` parameter is validated with `intval()`, the `module` parameter only has an `!empty()` check, which does NOT prevent SQL injection.

**Vulnerable Pattern:** ```php // Line 25: intval() protects predefined, but module is not sanitized! if (!empty(intval(post('predefined'))) && !empty(post('module'))) { // Line 26: Direct concatenation - VULNERABLE $dbo->query('UPDATE ... WHERE `id_module` = '.post('module')); } ```

## Exploitation ### Vulnerable Endpoint ``` POST /modules/stampe/actions.php ```

### Required Parameters ``` op=update id_record=1 predefined=1 (must be non-zero after intval()) module=[INJECTION_PAYLOAD] title=Test filename=test.pdf ```

### Authentication Requirement - Requires valid authenticated session (any user with access to Stampe module) - **VERIFIED:** Users with "Tecnici" group access can exploit (NOT admin-only!) - **PoC:** Demo at https://demo.osmbusiness.it with credentials tecnico/tec…