📦 OpenSTAManager

What is it?

Concept: OpenSTAManager is an open-source PHP management/ticketing platform (invoicing, interventions, support tickets) backed by MySQL. It is the kind of self-hosted internal business application that ends up on an intranet, is reachable by every employee, and is patched on nobody’s schedule.
Impact: Authenticated command injection in this class of application is code execution as the web server user (www-data), and its database configuration file sits in the webroot — so a foothold immediately yields DBMS credentials and the application’s full user table.

A standard LAMP-shaped deployment: PHP served by Apache or behind an nginx reverse proxy, with all state in a MySQL schema (openstamanager by default).
Database credentials live in plaintext in config.inc.php at the application root — readable by whatever user the web server runs as, which is the same user any web-shell lands as.
Application users are stored in the zz_users table with bcrypt password hashes.
The version is disclosed in an Information panel reachable from the dashboard, conventionally the i icon beside the logout control.

The version is one click from the dashboard. Every self-hosted business app of this shape has an About/Information panel, and it is the first thing to open after authenticating — it converts “I have a login” into a specific CVE search.
config.inc.php is the real prize of a www-data shell, not the shell itself. Plaintext DB credentials there lead to the user table, and the user table leads to crackable hashes for accounts that may also exist as system users.
bcrypt hashes in zz_users are slow but not safe — hashcat -m 3200 against rockyou.txt cracks weak passwords regardless of the algorithm’s cost factor. See Hashcat.
Application-user passwords are frequently reused as system-user passwords. A cracked hash for an application account is worth trying with su before anything else.
www-data is a foothold, not the goal. The interesting question after RCE is always which credentials the application stores, not what the web user can do directly.
CVE-2025-69212 is an authenticated command injection affecting this platform; a public PoC exists and supports both a --check mode and direct reverse-shell delivery — see HTB Machine - Enigma.

After landing a shell, in order: cat config.inc.php → mysql -u <user> -p <db> → show tables; → select * from zz_users;.
The shell arrives non-interactive; upgrade it (python3 -c 'import pty; pty.spawn("/bin/bash")', then stty raw -echo + fg) before running mysql, which needs a TTY for its password prompt.
Landing directory is typically /var/www/html/openstamanager, which is also www-data’s home in many packagings.

Fix: Patch to a release beyond the known command-injection advisories, and treat internal business applications as in-scope for the normal patch cycle rather than exempt from it.
Move config.inc.php outside the document root and restrict it to the web server user only.
Give the application a least-privilege MySQL account scoped to its own schema, never a shared or administrative one.
Do not let application credentials be reusable as system credentials; separate the namespaces.

File	Created
HTB Machine - Enigma	September 07, 2026

References: