Executive brief
OCS Inventory Ocsreports is an open-source IT asset and inventory management system. A SQL injection vulnerability in the query list management endpoint allows authenticated operators to manipulate database queries and extract sensitive information, including configuration data, user credentials, or asset inventory details.
Technical details
CVE-2026-76175 is a SQL injection vulnerability (CWE-89) in the /ocsreports/?function=save_query_list endpoint, specifically in the del_check parameter. The vulnerability exists because user-supplied input from authenticated operators is directly incorporated into SQL queries without parameterization or validation. An attacker with operator-level privileges can craft malicious SQL payloads in the del_check parameter to manipulate queries and extract arbitrary data from the database. The vulnerability requires authentication and operator-level permissions but no user interaction; it is network-reachable. A fix is available in version 2.12.6.
Affected products
- OCS Inventory Ocsreports before 2.12.6
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 2.12.6