OpenBMCS SQL Injection Vulnerability in Version 2.4

A SQL injection vulnerability has been identified in OpenBMCS version 2.4. This vulnerability allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. The issue arises because the 'id' GET parameter in the '/debug/obix_test.php' file is not properly sanitized before being used in SQL queries. Exploitation of this vulnerability could lead to unauthorized data access or manipulation.

Impact

Exploitation of this vulnerability could result in unauthorized access to database information, allowing attackers to manipulate or extract sensitive data.

Reproduction

To reproduce this vulnerability, an authenticated user must send a GET request to '/debug/obix_test.php' with a malicious 'id' parameter that includes injected SQL code. The lack of proper input sanitization will allow the injected SQL to be executed, potentially leading to data manipulation or extraction.