← Voltar para CVEs

CVE-2026-28516

HIGH

8.8

Descricao

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosLOW

Interacao do usuarioNONE

Publicado2/27/2026

Ultima modificacao3/10/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

opendcim:opendcim

Fraquezas (CWE)

CWE-89

Referencias

https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/(disclosure@vulncheck.com)

https://github.com/Chocapikk/opendcim-exploit(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/pull/1664(disclosure@vulncheck.com)

https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter(disclosure@vulncheck.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.