by Kastro
Paper/Archive/CVE-2026-28516

CVE-2026-28516

openDCIM openDCIM — openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

EPSS 1%public exploitCVSS 9.3
critical.is priorityof 100
51
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 64.9.649 × 2013.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

Affected

ProductAffectedFixed inSource
openDCIM≤ 23.04–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitchocapikk.com/posts/2026/opendcim-sqli-to-rceexploitgithub.com/Chocapikk/opendcim-exploitrefgithub.com/opendcim/openDCIM/pull/1664refgithub.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09refgithub.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434refgithub.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90writeupvulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter