openDCIM version 23.04 includes a flaw in the Config::UpdateParameter function where user‑supplied input is concatenated straight into SQL statements without sanitization. This is a CWE‑89 SQL Injection weakness that allows any authenticated user to execute arbitrary SQL commands against the database, potentially compromising data confidentiality, integrity, and availability.

The affected product is openDCIM, specifically all releases up to and including 23.04 that contain the vulnerable commit 4467e9c4.

The vulnerability scores a Base CVSS of 9.3, indicating critical severity, and has an EPSS probability of 24%, suggesting a relatively high likelihood of exploitation. It is not listed in the CISA KEV catalog, but publicly available proof‑of‑concept code demonstrates it is actively exploitable. Attackers who can authenticate locally or through a restricted user role are the most likely vectors, as the injection requires valid session credentials to trigger the vulnerable code.