Description

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-09T14:17:25.647Z",
  "pubdate": "2026-08-09T14:17:25.647Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in the lock-upme OPMS application, specifically within the IN Clause Handler component. The flaw resides in an unknown function processing the controllers/messages/message.go file, where improper sanitization of user-supplied input allows remote attackers to manipulate database queries.\nThe vulnerability is triggered via the ids argument, exposing the underlying database to unauthorized manipulation and data extraction. Because the product follows a rolling release strategy, specific affected or patched version numbers cannot be defined, and the commit identifier up to 831440f37a92c1568f2e071d5233bc873a9d8b09 marks the exposed scope.\nThe risk implications are severe, as successful exploitation enables remote adversaries to compromise database integrity, confidentiality, and availability without requiring prior authentication or elevated privileges, depending on the application context. The vendor was notified of this security issue prior to public disclosure but failed to provide a response or official patch.",
  "technicalDetails": "The vulnerability is classified as a SQL injection (SQLi) stemming from inadequate input validation and improper handling of dynamic parameters within database query constructions. The root cause lies in the IN Clause Handler component, specifically implemented in the controllers/messages/message.go file of the lock-upme OPMS codebase.\nThe attack vector is network-based, allowing remote adversaries to interact with the application and supply malicious payloads through the ids parameter. During the execution flow, the application dynamically constructs SQL queries intended to check or filter records using an SQL IN clause. Due to the lack of parameterized queries, prepared statements, or strict input type casting, user-supplied data within the ids argument is concatenated directly into the SQL command string.\nAn attacker exploits this behavior by injecting malicious SQL syntax into the ids parameter. When the application executes the crafted query against the backend database, the database interpreter parses the injected input as executable SQL commands rather than literal parameter values.\nDepending on the database configuration and application permissions, this injection flow facilitates various post-exploitation impacts, including unauthorized data retrieval, extraction of sensitive application records, database enumeration, and potential modification or deletion of stored data. The vulnerability affects all deployments utilizing code up to commit 831440f37a92c1568f2e071d5233bc873a9d8b09, and due to the rolling release nature of the software, continuous monitoring of the repository is required to identify corrective updates."
}