Exploitation Summary
CVE-2026-28515 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit, including a Metasploit module exploits/linux/http/opendcim_install_sqli_rce.
AI-analyzed exploit summary This Metasploit module exploits a SQL injection vulnerability in openDCIM's install.php (CVE-2026-28515) to achieve remote code execution by poisoning the Graphviz dot binary path and triggering its execution via report_network_map.php.
Description
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
Exploits (1)
This Metasploit module exploits a SQL injection vulnerability in openDCIM's install.php (CVE-2026-28515) to achieve remote code execution by poisoning the Graphviz dot binary path and triggering its execution via report_network_map.php.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H