CVE-2026-28516: OpenDCIM SQL Injection Vulnerability

CVE-2026-28516 Overview

CVE-2026-28516 is a SQL injection vulnerability in openDCIM version 23.04, affecting builds through commit 4467e9c4. The flaw resides in the Config::UpdateParameter method, which is invoked by the install.php and container-install.php handlers. These handlers pass user-supplied input directly into SQL statements through string interpolation, bypassing prepared statements and input sanitization. An authenticated user can execute arbitrary SQL queries against the underlying database, leading to data exfiltration, modification, or further system compromise. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers can execute arbitrary SQL statements against the openDCIM database, with public research demonstrating an escalation path from SQL injection to remote code execution.

Affected Products

openDCIM version 23.04
openDCIM builds through commit 4467e9c4
Deployments using install.php or container-install.php handlers

Discovery Timeline

2026-02-27 - CVE-2026-28516 published to NVD
2026-03-10 - Last updated in NVD database

Technical Details for CVE-2026-28516

Vulnerability Analysis

The vulnerability resides in Config::UpdateParameter, defined in config.inc.php around lines 75-90. This function constructs SQL UPDATE statements using direct string interpolation of caller-supplied parameter names and values. The installation handlers install.php (lines 420-434) and container-install.php forward HTTP request parameters into UpdateParameter without validation. Because these handlers remain reachable on configured instances, an authenticated user can inject SQL fragments that alter query semantics. Public analysis by Chocapikk demonstrates chaining this injection into remote code execution via writable database-backed configuration values. See the Chocapikk SQLi to RCE Analysis and the VulnCheck SQL Injection Advisory for the full chain.

Root Cause

The root cause is the use of PHP string interpolation to build SQL queries inside Config::UpdateParameter instead of using parameterized queries or prepared statements. No sanitization or allowlisting is applied to parameter names or values before concatenation into the query. The config.inc.php source reference shows the vulnerable construction pattern.

Attack Vector

The attack vector is network-based and requires an authenticated session. An attacker submits a crafted HTTP request to install.php or container-install.php containing SQL metacharacters within parameters consumed by UpdateParameter. The malicious payload is interpolated into the SQL statement and executed by the database engine. Successful exploitation enables arbitrary read or write operations against the openDCIM schema, and the GitHub opendcim-exploit repository documents a working proof-of-concept that pivots from SQL injection to code execution. The EPSS probability of 23.836% indicates elevated likelihood of exploitation activity.

Detection Methods for CVE-2026-28516

Indicators of Compromise

HTTP POST requests to install.php or container-install.php from authenticated sessions after initial setup is complete
Parameter values containing SQL syntax such as single quotes, UNION SELECT, --, ;, or INTO OUTFILE
Database audit log entries showing UPDATE statements against the openDCIM fac_Config table with anomalous values
Web server logs showing repeated requests to install handlers from a single source

Detection Strategies

Monitor web access logs for invocations of installer endpoints outside legitimate initial-deployment windows
Enable database query logging and alert on UPDATE statements containing nested subqueries originating from the openDCIM service account
Deploy a web application firewall (WAF) ruleset that inspects parameters submitted to openDCIM handlers for SQL injection signatures
Correlate authenticated user sessions with installer endpoint access to identify unauthorized post-install activity

Monitoring Recommendations

Review filesystem changes under the openDCIM web root for unexpected PHP files that may indicate SQLi-to-RCE pivoting
Track new or modified rows in configuration tables that map to executable file paths or templates
Alert on outbound network connections from the PHP runtime process associated with openDCIM
Track patch and version banners exposed by openDCIM to confirm fixed builds are deployed across the estate

How to Mitigate CVE-2026-28516

Immediate Actions Required

Restrict network access to install.php and container-install.php so they are unreachable from untrusted networks after deployment
Audit authenticated user accounts and revoke unnecessary privileges to reduce the exploitable population
Apply the upstream fix from openDCIM Pull Request #1664 once merged into a tagged release
Review database logs for evidence of prior exploitation against the fac_Config table

Patch Information

The upstream fix is tracked in openDCIM Pull Request #1664, with the specific code change documented in the pull request changes view. The patch refactors Config::UpdateParameter to use parameterized queries instead of string interpolation. Operators running openDCIM 23.04 at commit 4467e9c4 or earlier should rebuild from a fixed commit and redeploy.

Workarounds

Remove or rename install.php and container-install.php after the initial installation completes
Place the openDCIM application behind an authenticating reverse proxy that blocks installer paths
Apply a WAF rule that rejects requests to installer endpoints containing SQL metacharacters in POST bodies
Run the openDCIM database account with the minimum privileges required for normal application operation

bash

# Example nginx location block to deny access to installer handlers post-deployment
location ~ ^/(install|container-install)\.php$ {
    deny all;
    return 403;
}