Executive brief
OCS Inventory NG's Ocsreports component is an asset management system that tracks hardware and software across corporate IT infrastructure. A SQL injection vulnerability in the admin_double endpoint allows authenticated operators to bypass database query safeguards and extract sensitive inventory data, including potentially confidential hardware and software information.
Technical details
A SQL injection vulnerability exists in the /ocsreports/index.php?function=admin_double endpoint where the selected_grp_dupli[] parameter's ID field values are improperly processed and directly incorporated into SQL queries without parameterization or validation (CWE-89). An authenticated user with operator-level privileges can craft malicious SQL payloads within the ID field to alter query logic and extract database records. The attack requires valid authentication and operator privileges but no user interaction or special conditions; the vulnerability is network-accessible. Successful exploitation allows an attacker to enumerate and exfiltrate arbitrary data from the OCS Inventory NG database. A fix is available in version 2.12.6.
Affected products
- OCS Inventory Ocsreports 2.12.4 and earlier
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Fixed in version 2.12.6