Description
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openDCIM | openDCIM | ≤ 23.04 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
openDCIM install.php SQL Injection to RCE
exploit/linux/http/opendcim_install_sqli_rce
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ technical-description exploit
- https://github.com/Chocapikk/opendcim-exploit exploit
- https://github.com/opendcim/openDCIM/pull/1664 issue-tracking patch
- https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 issue-tracking patch
- https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php#L420-L434
- https://github.com/opendcim/openDCIM/blob/4467e9c4/config.inc.php#L75-L90
- https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter third-party-advisory