openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 27, 2026 · NIST NVD

   Detected

   openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

2. Jul 14, 2026 · NIST NVD

   Updated

   openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

Affected

• cpe opendcim/opendcim23.04

Sources

• CVE.orgVulnerability recordCVE-2026-28516

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-28516

  openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or p

  nvd.nist.gov

References

• Exploit · chocapikk.com
• Exploit · github.com
• Product · github.com
• Product · github.com
• Issue Tracking · github.com
• Issue Tracking · github.com
• Third Party Advisory · vulncheck.com