A function in the OPMS controller file controllers/messages/message.go that processes an IN clause can be manipulated by altering the ids argument, allowing attackers to inject arbitrary SQL statements. This flaw can compromise data confidentiality, integrity, and potentially availability by enabling unauthorized data reads, modifications, or deletions. The weakness falls under input validation failures and SQL injection (CWE-74, CWE-89).

The vulnerability affects all releases of lock‑upme OPMS up to the commit 831440f37a92c1568f2e071d5233bc873a9d8b09. Because the product follows a rolling release model, exact version ranges are not specified, meaning any unpatched release is likely vulnerable.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the issue is not listed in CISA KEV, suggesting low to moderate exploitation likelihood. Attackers can execute the injection remotely, likely without authentication, by sending crafted requests to the messages endpoint. While no public exploits have been reported, the absence of a vendor patch and the nature of the flaw raise a moderate risk for affected deployments.