CVE-2026-28516

EUVD-2026-9097
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
opendcimopendcim
23.04
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
https://github.com/Chocapikk/opendcim-exploit
https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90
https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434
https://github.com/opendcim/openDCIM/pull/1664
https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09
https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter