CVE-2026-28516

UNKNOWN 0.0

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

CWE	CWE-89
Vendor	opendcim
Product	opendcim
Published	Feb 27, 2026
Last Updated	Mar 2, 2026

Stay Ahead of the Next One

Get instant alerts for opendcim opendcim

Be the first to know when new unknown vulnerabilities affecting opendcim opendcim are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

openDCIM / openDCIM

0 ≤ 23.04

References

NVD ↗ CVE.org ↗ EPSS Data ↗

chocapikk.com: https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ github.com: https://github.com/Chocapikk/opendcim-exploit github.com: https://github.com/opendcim/openDCIM/pull/1664 github.com: https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 github.com: https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434 github.com: https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90 vulncheck.com: https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter

Credits

Valentin Lobstein (Chocapikk)