Executive Summary

[{'type': 'paragraph', 'content': "CVE-2025-69216 is an authenticated SQL injection vulnerability in OpenSTAManager's Scadenzario (Payment Schedule) print template affecting versions up to 2.9.8."}, {'type': 'paragraph', 'content': 'The vulnerability exists because the id_anagrafica parameter is directly concatenated into an SQL query without proper sanitization or use of prepared statements, allowing attackers to manipulate SQL commands.'}, {'type': 'paragraph', 'content': 'Any authenticated user, regardless of privilege level, can exploit this flaw to perform error-based SQL injection attacks that extract sensitive data from the database.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated user with low privileges to gain complete read access to the database.

• Extraction of sensitive data such as admin credentials, including usernames, emails, and partial bcrypt password hashes.
• Access to customer information and financial records stored in the database.

The impact includes a high risk to confidentiality and integrity of the system and its data, potentially leading to unauthorized data disclosure and further exploitation.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the vulnerable endpoint for SQL injection using the id_anagrafica parameter in the URL /pdfgen.php?ptype=scadenzario&id_anagrafica=[INJECTION_PAYLOAD].'}, {'type': 'paragraph', 'content': 'Proof of Concept (PoC) exploitation steps include triggering SQL syntax errors by injecting malformed input and extracting database information using error-based SQL injection techniques.'}, {'type': 'paragraph', 'content': 'Automated tools like SQLMap can be used to confirm the presence of the vulnerability with confirmed injection types including Boolean-based blind, error-based, and time-based blind SQL injection.'}, {'type': 'list_item', 'content': 'Use SQLMap with a command similar to: sqlmap -u "http://target/pdfgen.php?ptype=scadenzario&id_anagrafica=1" --cookie="[valid_auth_cookie]" --dbs'}, {'type': 'list_item', 'content': 'Manually test by injecting malformed input in the id_anagrafica parameter to trigger SQL errors, e.g., id_anagrafica=1\' or id_anagrafica=1"'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint to only trusted authenticated users and monitoring for suspicious activity on the /pdfgen.php?ptype=scadenzario endpoint.

Since no patch is currently available, avoid using the affected versions (2.9.8 and earlier) or disable the Scadenzario print template functionality if possible.

Implement input validation and sanitization on the id_anagrafica parameter and other user inputs to prevent SQL injection.

Use prepared statements with parameterized queries instead of directly concatenating user input into SQL queries.

Ensure that only authenticated users with the minimum necessary privileges can access the application.

Useful 0 Not Useful 0