Description
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openDCIM | openDCIM | ≤ 23.04 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
openDCIM install.php SQL Injection to RCE
exploit/linux/http/opendcim_install_sqli_rce
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ technical-description exploit
- https://github.com/Chocapikk/opendcim-exploit exploit
- https://github.com/opendcim/openDCIM/pull/1664 issue-tracking patch
- https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09 issue-tracking patch
- https://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L7
- https://github.com/opendcim/openDCIM/blob/4467e9c4/report_network_map.php#L467
- https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter third-party-advisory