openDCIM version 23.04 contains a flaw in the Config::UpdateParameter function where user supplied input is interpolated directly into SQL statements without sanitization. An attacker who is authenticated to the web application can inject and execute arbitrary SQL commands against the underlying database, potentially compromising data confidentiality, integrity, and availability.

The affected product is openDCIM, specifically all releases up to and including 23.04 that contain the vulnerable commit 4467e9c4.

The vulnerability scores a Base CVSS of 9.3, indicating critical severity, and has an EPSS probability of 21%, suggesting a relatively high likelihood of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog, but publicly available proof‑of‑concept code demonstrates it is actively exploitable. Attackers who can authenticate locally or through a restricted user role are the most likely vectors, as the injection requires valid session credentials to trigger the vulnerable code.