CVE-2026-28516

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/	Third Party Advisory Exploit
https://github.com/Chocapikk/opendcim-exploit	Exploit
https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90	Product
https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434	Product
https://github.com/opendcim/openDCIM/pull/1664	Issue Tracking Patch
https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09	Issue Tracking Patch
https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-27 23:16

Updated : 2026-03-10 14:46

NVD link : CVE-2026-28516

Mitre link : CVE-2026-28516

CVE.ORG link : CVE-2026-28516

JSON object : View

Products Affected

opendcim

opendcim

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-28516", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-02-27T23:16:06.180", "references": [{"url": "https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/", "tags": ["Third Party Advisory", "Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Chocapikk/opendcim-exploit", "tags": ["Exploit"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opendcim/openDCIM/pull/1664", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09", "tags": ["Issue Tracking", "Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database."}, {"lang": "es", "value": "openDCIM versi\u00f3n 23.04, a trav\u00e9s del commit 4467e9c4, contiene una vulnerabilidad de inyecci\u00f3n SQL en Config::UpdateParameter. Los manejadores install.php y container-install.php pasan la entrada proporcionada por el usuario directamente a sentencias SQL usando interpolaci\u00f3n de cadenas sin sentencias preparadas o saneamiento de entrada adecuado. Un usuario autenticado puede ejecutar sentencias SQL arbitrarias contra la base de datos subyacente."}], "lastModified": "2026-03-10T14:46:09.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F420481A-7455-46AE-A482-AB2FA8468428"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}