PT-2026-22426 · Opendcim · Opendcim

Valentin Lobstein · Published 2026-02-27 · Updated 2026-03-10 · CVE-2026-28516

Positive Technologies · (AI Summary)

CVSS v4.0

9.3

Critical

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openDCIM versions through 23.04 commit 4467e9c4

Description The software contains a SQL injection issue in the Config::UpdateParameter function. The install.php and container-install.php handlers directly incorporate user-provided input into SQL statements using string interpolation, lacking prepared statements or adequate input sanitization. An authenticated user can execute arbitrary SQL statements against the database. The vulnerable parameters are passed to the SQL statements without proper validation.

Recommendations Versions prior to 23.04 commit 4467e9c4 should be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-28516

Affected Products

Opendcim

References · 16

• 🔥 https://github.com/Chocapikk/opendcim-exploit · Exploit
• 🔥 https://chocapikk.com/posts/2026/opendcim-sqli-to-rce · Exploit
• https://github.com/opendcim/openDCIM/pull/1664 · Patch
• https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28516 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28516 · Vendor Advisory
• https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90 · Note
• https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434 · Note
• https://twitter.com/VulmonFeeds/status/2027536139075166249 · Twitter Post
• https://vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter · Note
• https://t.me/CVEtracker/46011 · Telegram Post
• https://t.me/proxy_bar/3170 · Telegram Post
• https://twitter.com/ptdbugs/status/2029208213950759141 · Twitter Post
• https://twitter.com/Chocapikk_/status/2027525689491193901 · Twitter Post
• https://t.me/cveNotify/154909 · Telegram Post