← Zuruck zu CVEs

CVE-2026-28516

HIGH

8.8

Beschreibung

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht2/27/2026

Zuletzt geandert3/10/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

opendcim:opendcim

Schwachen (CWE)

CWE-89

Referenzen

https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/(disclosure@vulncheck.com)

https://github.com/Chocapikk/opendcim-exploit(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/pull/1664(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.