{"uuid": "314597fd-3a9c-4b33-9170-e579af97cbf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in openDCIM's install.php\\n          endpoint (CVE-2026-28515) to achieve remote code execution. The install.php\\n          script remains accessible after installation and processes LDAP configuration\\n          parameters via UpdateParameter() without authentication or input sanitization,\\n          allowing stacked SQL queries.\\n\\n          The exploit chain works by injecting SQL through the LDAP configuration form\\n          to overwrite the Graphviz dot binary path in fac_Config, then triggering\\n          report_network_map.php which calls exec() with the poisoned value. A backup\\n          of the original configuration is created before exploitation and restored\\n          after payload delivery.\\n\\n          Tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache.\", \"disclosure_date\": \"2026-02-28\", \"fullname\": \"exploit/linux/http/opendcim_install_sqli_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-12 20:56:33 +0000\", \"name\": \"openDCIM install.php SQL Injection to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/opendcim_install_sqli_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/opendcim_install_sqli_rce\", \"references\": [\"CVE-2026-28515\", \"CVE-2026-28516\", \"CVE-2026-28517\", \"URL-https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php\", \"URL-https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter\", \"URL-https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter\", \"URL-https://github.com/Chocapikk/opendcim-exploit\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:49.046954Z"}