openDCIM install.php SQL Injection to RCE

Classification basis

The artifact is a complete Metasploit exploit module that chains SQL injection to OS command injection for remote code execution. It includes a check method for vulnerability detection, but its primary purpose is exploitation: it injects malicious SQL to overwrite a configuration value, then triggers command execution via a separate endpoint. The module delivers payloads (command shell or dropper) and includes cleanup logic.

Requirements

• Target must be running a vulnerable version of openDCIM (23.04 through 25.01) with install.php accessible.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:19-31
• The install.php endpoint must accept POST requests with ldapaction=Set and process LDAP configuration parameters without authentication.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:108-112

Observed behavior

• Sends a GET request to install.php to check if the endpoint is accessible and appears to be openDCIM.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:92-101
• Performs three time-based SQL injection tests by sending POST requests with a SLEEP() payload in a random LDAP field and measuring response time.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:103-116
• Creates a backup table of the current LDAP and dot configuration values from fac_Config using a stacked SQL query.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:175-179
• Injects a stacked SQL UPDATE query to overwrite the dot parameter in fac_Config with the attacker-supplied command.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:182-185
• Triggers execution of the poisoned dot value by sending a GET request to report_network_map.php, which calls exec() with the database value.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:194-201
• Restores the original configuration from the backup table and drops the backup table after exploitation.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:188-191

Observables

Exploit Chain

SQL injection in install.php LDAP parameters overwrites fac_Config.dot value, then triggers report_network_map.php to execute the injected command via exec()The module's exploit method uses inject_sql to poison the dot configuration parameter and trigger_dot to request report_network_map.php, which is the documented OS command injection vector.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:121-141modules/exploits/linux/http/opendcim_install_sqli_rce.rb:182-186modules/exploits/linux/http/opendcim_install_sqli_rce.rb:194-202

Configuration Restoration

Module backs up fac_Config entries before exploitation and restores them in cleanup_configThe backup_config method creates a backup table, and restore_config restores original values and drops the backup table. This is consistent with the module's stated goal of being crash-safe and minimizing side effects.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:148-155modules/exploits/linux/http/opendcim_install_sqli_rce.rb:175-180modules/exploits/linux/http/opendcim_install_sqli_rce.rb:188-192

Payload Delivery

Module delivers Metasploit payloads via cmd or dropper targetsThe exploit method uses payload.encoded for the :cmd target and execute_cmdstager for the :dropper target, both standard Metasploit patterns for delivering operator-chosen payloads.modules/exploits/linux/http/opendcim_install_sqli_rce.rb:127-133modules/exploits/linux/http/opendcim_install_sqli_rce.rb:138-141