CVE-2026-28515: openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and…

PriorityP179high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

1.16%

63.1th percentile

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
opendcim	opendcim	<= 23.04	—
opendcim	opendcim	—	—

Detection & IOCsextracted from sources · hover to see the quote

urlinstall.php↗

urlcontainer-install.php↗

urlreport_network_map.php↗

pathinstall.php↗

→Monitor for unauthenticated or low-privileged HTTP requests to install.php and container-install.php on openDCIM deployments, especially POST requests containing LDAP configuration parameters. ↗
→In Docker/REMOTE_USER deployments, alert on any unauthenticated access to install.php or container-install.php, as authentication may not be enforced. ↗
→Detect exploit chain activity: SQL injection via LDAP config form in install.php to overwrite the Graphviz dot binary path in fac_Config table, followed by a request to report_network_map.php to trigger exec() with the poisoned value. ↗
→Alert on stacked SQL queries submitted via the 'dot' parameter or LDAP configuration parameters in openDCIM HTTP requests, as these are used for SQL injection leading to RCE. ↗
→The exploit chain can be completed in as few as five HTTP requests; correlate sequences of requests to install.php and report_network_map.php from the same source IP as a high-fidelity attack indicator. ↗
→Threat actor activity has been attributed to a single Chinese IP using an automated tool (Vulnhuntr-based) to scan for vulnerable openDCIM installations and drop PHP web shells; monitor for new PHP files created in the web root following requests to install.php. ↗

·RCE via this vulnerability requires a specific exploit chain (CVE-2026-28515 + CVE-2026-28516 + CVE-2026-28517); missing authorization alone enables config modification but full RCE depends on chaining with SQL injection and OS command injection. ↗
·In Docker deployments where REMOTE_USER is set without authentication enforcement, install.php may be reachable without any credentials, significantly widening the attack surface. ↗
·The Metasploit module modifies fac_Config (Graphviz dot binary path) during exploitation but creates a backup and restores it after payload delivery; forensic analysis should check for temporary config changes in fac_Config as an artifact of exploitation. ↗
·Affected versions span openDCIM 23.04 through commit 4467e9c4; the Metasploit module was tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vulncheck9.3CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.