Executive brief
openDCIM, an open-source tool for managing data center infrastructure, contains a security flaw in its configuration handling. This vulnerability allows an authenticated user to manipulate the underlying database by injecting malicious commands into setup forms. In practice, this can lead to unauthorized access to sensitive data, modification of system settings, or a complete takeover of the application when combined with other flaws.
Technical details
A SQL injection vulnerability exists in openDCIM through version 23.04 (commit 4467e9c4) within the Config::UpdateParameter function. The application's install.php and container-install.php handlers process user-supplied LDAP configuration parameters using direct string interpolation into SQL UPDATE statements without sanitization or prepared statements. Because the application uses PDO with MySQL, an attacker can utilize stacked queries to execute arbitrary SQL commands. While the vulnerability typically requires authentication, many Docker-based deployments are configured in a way that makes these endpoints accessible without credentials. This flaw can be chained with other vulnerabilities (like CVE-2026-28517) to achieve remote code execution (RCE).
Affected products
- openDCIM openDCIM through 23.04 (commit 4467e9c4)
Timeline
- 2026-02-26: disclosed: Initial discovery and blog post by Chocapikk
- 2026-02-27: advisory: CVE published to NVD
References
- https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
- https://github.com/Chocapikk/opendcim-exploit
- https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php
- https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php
- https://github.com/opendcim/openDCIM/pull/1664
- https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09
- https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter