Description
OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to /debug/obix_test.php with malicious 'id' values to extract database information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OPEN BMCS | OpenBMCS | 2.4 | — |
References
- ExploitDB-50668 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2022-5692) third-party-advisory
- VulnCheck Advisory: OpenBMCS SQL Injection via obix_test.php third-party-advisory