Which versions of openDCIM are affected by CVE-2026-28516?

openDCIM 23.04 contains a critical SQL injection vulnerability in installation handlers that permits unauthenticated access to execute arbitrary SQL and potentially achieve remote code execution;…. A patch is available.

Is there a public PoC exploit available for CVE-2026-28516?

Yes, a public proof-of-concept exploit is available for CVE-2026-28516. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-28516?

Within 24 hours, identify all systems running openDCIM 23.04 and determine if install.php and container-install.php handlers are accessible from untrusted networks; if accessible, restrict or disable access immediately. Within 7 days, apply the vendor-released patch and upgrade openDCIM to the patched version indicated in the vendor advisory. Within 30 days, verify patch deployment across all instances, review authentication logs and database audit trails for exploitation attempts, and confirm that installation handlers are no longer accessible from untrusted networks.

openDCIM CVE-2026-28516

Q: What is the CVSS score of CVE-2026-28516?

CVE-2026-28516 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

CRITICAL

SQL Injection (CWE-89)

2026-02-27 disclosure@vulncheck.com

PHP SQLi Opendcim

9.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity SQLi; description requires an authenticated user so PR:L (not PR:N), with full C/I/A impact via arbitrary SQL and the documented RCE chain.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 19:32 vuln.today

Analysis Updated

Jul 14, 2026 - 19:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 19:22 vuln.today

cvss_changed

Severity Changed

Jul 14, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

Jul 14, 2026 - 19:22 NVD

8.8 (HIGH) 9.3 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 10, 2026 - 14:46 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 14:46 nvd

Patch available

CVE Published

Feb 27, 2026 - 23:16 nvd

HIGH 8.8

DescriptionCVE.org

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

AnalysisAI

SQL injection in openDCIM 23.04 (up to commit 4467e9c4) lets attackers execute arbitrary SQL through the Config::UpdateParameter routine, which the install.php and container-install.php handlers reach with unsanitized, string-interpolated input. Publicly available exploit code exists (Chocapikk PoC and write-up) demonstrating a chain from SQLi to remote code execution, though it is not listed in CISA KEV and EPSS rates real-world exploitation probability at only 0.04%. Note a data conflict: the CVSS 4.0 vector encodes PR:N (unauthenticated) while the description states an authenticated user is required.

Technical ContextAI

openDCIM is an open-source, PHP/MySQL data center infrastructure management (DCIM) web application for tracking cabinets, devices, power and cabling. The root cause is CWE-89 (SQL Injection): in config.inc.php, Config::UpdateParameter built the query as UPDATE fac_Config SET Value="$value" WHERE Parameter="$parameter" using direct PHP string interpolation of user-supplied values, with no prepared statements. The vendor fix (PR #1664) rewrites the query to a PDO prepared statement with :value/:parameter placeholders, and additionally adds a $person->SiteAdmin authorization gate to the ldapaction=Set path in both install.php and container-install.php, indicating those handlers previously lacked an admin check. The same PR also hardens report_network_map.php by wrapping exec() arguments in escapeshellarg() and validating the dot binary - consistent with the published SQLi-to-RCE chain. CPE confirms the single affected build: cpe:2.3:a:opendcim:opendcim:23.04.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/opendcim/openDCIM/pull/1664, which converts Config::UpdateParameter to a PDO prepared statement (:value/:parameter placeholders) and adds a $person->SiteAdmin authorization check to the ldapaction=Set path in install.php and container-install.php. If you cannot deploy the patch immediately, remove or restrict access to install.php and container-install.php after initial setup (these installer scripts should not remain reachable in production; deleting or web-server-denying them closes the injection entrypoint at the cost of blocking future re-install or config-import operations), and place the openDCIM UI behind authenticated VPN/IP allow-listing to limit who can reach the endpoints. Also pick up the report_network_map.php hardening (escapeshellarg on exec arguments and dot-binary validation) from the same PR to break the documented SQLi-to-RCE chain. See the exploit write-up at https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/ and PoC at https://github.com/Chocapikk/opendcim-exploit to validate mitigations.