openDCIM SQL Injection Vulnerability in people_depts.php

A SQL injection vulnerability has been identified in openDCIM versions through 23.04, specifically in the people_depts.php file. The issue arises because the application does not use prepared statements, allowing for the manipulation of SQL queries and potentially unauthorized access to the database.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Remediation

The vulnerability can be addressed by modifying the code in people_depts.php to use prepared statements for database queries, which will help prevent SQL injection attacks.