CVE-2026-24419: Devcode Openstamanager SQLi Vulnerability

CVE-2026-24419 Overview

OpenSTAManager is an open source management software designed for technical assistance and invoicing workflows. CVE-2026-24419 identifies a critical Error-Based SQL Injection vulnerability in OpenSTAManager v2.9.8 and earlier versions. The vulnerability exists within the Prima Nota (Journal Entry) module's add.php file, where the application fails to properly validate that comma-separated values from the id_documenti GET parameter are integers before incorporating them into SQL IN() clauses. This improper input validation allows attackers to inject arbitrary SQL commands and extract sensitive database information through XPATH error messages.

Critical Impact

Authenticated attackers can exploit this SQL Injection vulnerability to extract sensitive database contents, potentially including user credentials, financial records, and customer data stored within the OpenSTAManager application.

Affected Products

• Devcode OpenSTAManager v2.9.8 and earlier
• OpenSTAManager installations using the Prima Nota (Journal Entry) module
• All deployments with the vulnerable add.php endpoint accessible

Discovery Timeline

• 2026-02-06 - CVE-2026-24419 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-24419

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) occurs due to insufficient input validation in the Prima Nota module's request handling. The application accepts comma-separated values via the id_documenti GET parameter and directly incorporates them into SQL IN() clauses without properly verifying that each value is a valid integer. This creates an injection point where malicious SQL syntax can be appended to the parameter values.

The error-based nature of this vulnerability means attackers can leverage database error messages—specifically XPATH error output—to exfiltrate data from the underlying database. This technique allows for systematic extraction of database schema information, table contents, and sensitive application data without requiring blind injection techniques.

Root Cause

The root cause stems from improper input validation in the add.php file within the Prima Nota module. When processing the id_documenti parameter, the application expects a comma-separated list of document identifiers. However, the code fails to sanitize or validate these values before constructing SQL queries. The lack of parameterized queries or prepared statements, combined with missing integer type validation, allows attackers to break out of the intended SQL context and inject arbitrary commands.

Attack Vector

This vulnerability is exploitable over the network by authenticated users. The attack requires low privileges—a standard user account with access to the Prima Nota module is sufficient to exploit the vulnerability. No user interaction is required beyond the attacker submitting a crafted request. The attacker manipulates the id_documenti GET parameter by appending SQL injection payloads to the comma-separated values. When the application processes this input and generates an SQL error, the XPATH error messages reveal database content to the attacker.

The exploitation flow involves crafting malicious GET requests to the vulnerable add.php endpoint, where the injected SQL leverages XPATH functions like extractvalue() or updatexml() to force error messages containing extracted data.

Detection Methods for CVE-2026-24419

Indicators of Compromise

• Unusual GET requests to the Prima Nota module's add.php endpoint containing SQL syntax characters such as single quotes, semicolons, or XPATH function names
• Database error messages in application logs containing XPATH-related errors or extracted data fragments
• Multiple rapid requests to the add.php endpoint from the same authenticated session with varying id_documenti parameter values
• Evidence of data exfiltration attempts through error-based injection patterns in web server access logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in the id_documenti parameter, specifically watching for non-numeric characters in comma-separated lists
• Monitor application and database logs for XPATH-related error messages that may indicate exploitation attempts
• Configure intrusion detection systems to alert on requests containing common SQL injection keywords targeting the Prima Nota module endpoints
• Review authentication logs for accounts exhibiting suspicious activity patterns around the affected endpoints

Monitoring Recommendations

• Enable detailed logging for all requests to the /modules/prima_nota/add.php endpoint and related Prima Nota module files
• Set up alerts for database query errors that reference XPATH functions or contain unexpected data extraction patterns
• Implement rate limiting and anomaly detection for authenticated sessions accessing the journal entry functionality
• Regularly audit access logs for the Prima Nota module to identify potential reconnaissance or exploitation attempts

How to Mitigate CVE-2026-24419

Immediate Actions Required

• Upgrade OpenSTAManager to the latest patched version that addresses CVE-2026-24419
• If immediate patching is not possible, restrict access to the Prima Nota module to only trusted administrative users
• Implement WAF rules to block requests containing SQL injection patterns in the id_documenti parameter
• Review database access logs and application logs for signs of prior exploitation

Patch Information

Devcode has published a security advisory addressing this vulnerability. Administrators should consult the GitHub Security Advisory GHSA-4j2x-jh4m-fqv6 for official patch information and upgrade instructions. The fix involves implementing proper input validation to ensure all values in the id_documenti parameter are validated as integers before being used in SQL queries, along with the use of parameterized queries.

Workarounds

• Implement server-side input validation that strictly enforces integer-only values for the id_documenti parameter using allowlist validation
• Deploy a Web Application Firewall with SQL injection detection rules specifically targeting the Prima Nota module endpoints
• Restrict network access to the OpenSTAManager application to trusted IP ranges using firewall rules
• Disable or remove access to the Prima Nota module if it is not critical to business operations until patching can be completed

# Example: Apache mod_rewrite rule to block suspicious id_documenti values
# Add to .htaccess or Apache configuration for temporary mitigation
RewriteEngine On
RewriteCond %{QUERY_STRING} id_documenti=.*[^0-9,] [NC]
RewriteRule ^modules/prima_nota/add\.php$ - [F,L]