EUVD-2026-54922
GHSA-88g6-3r36-3589
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SQL injection requires low-privileged authentication; no scope change; partial impact on confidentiality, integrity, and availability only.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in lock-upme OPMS allows remote low-privileged attackers to manipulate the ids argument within the IN Clause Handler of controllers/messages/message.go, potentially enabling unauthorized read and write access to underlying database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity, requiring only a valid low-privileged session, yielding partial confidentiality, integrity, and availability impact. No vendor patch exists as the maintainer did not respond to the coordinated disclosure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
OPMS is a project management or operations system developed by lock-upme, written in Go. The vulnerable code path resides in controllers/messages/message.go, specifically in the component responsible for handling IN clause construction in SQL queries. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied values in the ids parameter are interpolated directly into a SQL IN clause without parameterization or sanitization - a pattern common when developers manually join arrays of IDs into query strings rather than using prepared statements with bound parameters. The CPE identifier cpe:2.3:a:lock-upme:opms:*:*:*:*:*:*:*:* covers all versions of the product through commit 831440f37a92c1568f2e071d5233bc873a9d8b09, which represents the last known vulnerable state reported to VulDB.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond to disclosure. Operators should treat the source code directly: review controllers/messages/message.go and replace any string-concatenation approach to building the SQL IN clause with Go database/sql parameterized queries or a query builder that supports safe binding of slice arguments. As an immediate compensating control, restrict network access to OPMS message endpoints to trusted internal network segments or authenticated VPN clients only, reducing the reachable attack surface (trade-off: reduces accessibility for remote users). Deploying a WAF rule to detect and block SQL metacharacters - specifically commas, single quotes, and SQL keywords - within the ids parameter is a second compensating layer, though this risks false positives for IDs containing special characters and can be bypassed by encoding variations. Enable database query logging and alert on anomalous IN clause lengths or SQL error responses. Monitor https://vuldb.com/vuln/387208 for any upstream patch or commit activity.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today