CVE-2026-76175: Multiple vulnerabilities in Ocsreports for OCS Inventory NG
SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ocsreports for OCS Inventory NGto a version that resolves this vulnerability.Fixed in 2.12.6
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Ocsreports and have operator privileges. The issue is therefore most relevant where operator accounts are broadly assigned, compromised, or accessible to untrusted users.
What access and endpoint are involved?
The vulnerable input is the del_check parameter sent to the /ocsreports/?function=save_query_list endpoint. Exploitation requires manipulating that parameter in an authenticated request.
What could an attacker obtain through exploitation?
The vulnerable parameter can be used to alter the SQL query and extract information from the database.