An arbitrary file upload vulnerability in OpenSTAManager version 2.10 and earlier allows authenticated attackers with administrative access to achieve remote code execution on the underlying system.

This is an arbitrary file upload vulnerability located in the module update functionality via the modules/aggiornamenti/upload_modules.php script, requiring high privileges for successful exploitation.

A successful exploit allows malicious actors to upload arbitrary files, potentially leading to full remote code execution and complete system compromise. The CVSS score of 7.2 reflects a high severity due to the potential for total technical impact on confidentiality, integrity, and availability, even though the attack requires administrative privileges.

Immediate Action: Review vendor channels for the latest security advisory and apply available updates or disable the vulnerable module update functionality until a patch is deployed.

Proactive Monitoring: Monitor web server logs for suspicious requests to upload scripts or unusual file creation events within the application directory.

Compensating Controls: Implement file type validation and execution restrictions on upload directories via a Web Application Firewalls (WAF) or web server configuration.

Public Exploit Available: Yes, public proof-of-concept repositories exist on GitHub.

Given the high severity of this vulnerability and the availability of public proof-of-concept exploit code, organizations utilizing OpenSTAManager must audit their administrative accounts and apply vendor patches immediately upon release to prevent potential system compromise.