Executive brief
Open STA Manager, an open-source technical assistance and billing management platform, contains a security flaw in its backup module. An authenticated user, such as a technician or customer, can exploit this to download sensitive system files from the server. This could lead to the exposure of configuration files, passwords, or other private data, potentially compromising the entire server.
Technical details
A path traversal vulnerability exists in Open STA Manager 2.3 within the 'modules/backup/actions.php' component. The application fails to properly sanitize the 'file' parameter when the 'op' parameter is set to 'getfile'. An authenticated attacker (including low-privileged roles like Technicians or Customers) can use '../' sequences in a GET request to bypass the intended backup directory and read arbitrary files from the underlying operating system. This is a classic CWE-22 flaw where the 'file_get_contents()' function is called on user-controlled input without validation. Exploitation allows for full disclosure of sensitive system files reachable by the web server user.
Affected products
- Open STA Manager Open STA Manager 2.3
Timeline
- 2018-10-25: disclosed: Exploit published on Exploit-DB
- 2026-05-30: advisory: CVE published and NVD record created