Executive brief
OpenSTAManager is a business management application that manages users and groups. An attacker with user creation privileges can inject malicious HTML into a group name field, which is then rendered without sanitization in the user interface. When other users view the injected content or click on malicious links, they may be redirected to attacker-controlled sites or exposed to phishing attacks, potentially compromising credentials or sensitive information.
Technical details
This is an HTML injection vulnerability (CWE-79) in the modules/utenti/edit.php file. The vulnerability occurs when user-supplied input in the group name field is passed directly to the getTranslation('title') method and rendered in an HTML context without proper sanitization: `'<span class="text-primary">'.$group->getTranslation('title').'</span>`. An authenticated user with group creation privileges can inject arbitrary HTML elements (such as anchor tags with href attributes pointing to malicious URLs). The injected content is rendered and displayed whenever the group is referenced in the application interface, affecting any user who views pages containing the compromised group. The vulnerability requires high privileges (group creator role) and user interaction (clicking the link), but allows attackers to conduct phishing attacks or redirect users to malicious sites. A patch is available in version 2.11-beta and later.
Affected products
- devcode-it OpenSTAManager <= 2.10.1
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fixed in version 2.11-beta