关键信息 漏洞名称 Advisories: - 漏洞严重性 Severity: Critical 发布日期 Date: 2/27/2026 CVE_ID CVE_ID: CVE-2026-28516 参考链接 References: - Researcher Blog - Go-Exploit Module - Closed GitHub PR - Proposed Patch - Vulnerable Code L420-L434 - Vulnerable Code L75-L90 报告者 Credit: Valentin Lobstein (Chocapikk) 漏洞描述 Description: - openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.