Description

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T14:17:34.517Z",
  "pubdate": "2026-08-19T14:17:34.517Z",
  "executiveSummary": "Dell OpenManage Enterprise versions prior to 4.7.0 are affected by an Improper Neutralization of Special Elements used in an SQL Command vulnerability, commonly referred to as SQL Injection.\nThis security flaw exposes the application to database-level manipulation through maliciously crafted input vectors handled improperly by the underlying database query generation logic.\nA successfully executed exploit allows a remote attacker with low privileges to achieve script injection within the context of the affected system.\nThe risk implications include potential compromise of application integrity and unauthorized execution of arbitrary script content within vulnerable interfaces.\nExploitation requires remote network access to the target system and low-level user authentication, enabling attackers to interact with vulnerable endpoints processing unsanitized parameters.",
  "technicalDetails": "The vulnerability stems from insufficient validation and sanitization of user-supplied input prior to its inclusion in database queries executed by Dell OpenManage Enterprise.\nThe affected component fails to properly neutralize special characters and control elements utilized within SQL commands, allowing malicious input to alter the intended query structure.\nThe attack vector involves a remote attacker leveraging low-privileged access to transmit crafted requests containing malicious SQL payloads to vulnerable application endpoints.\nUpon receipt, the application dynamically constructs and executes database queries using the unsanitized input, leading to SQL injection.\nThe architecture's failure to enforce parameterization or strict input typing mechanisms enables the injection of arbitrary commands or script elements that are subsequently processed and reflected by the system.\nThe resulting impact of this injection vector facilitates script injection, allowing the execution of unauthorized scripts within the application environment.\nPrerequisites for this attack include network exposure of the management interface, valid low-privileged authentication credentials, and the presence of vulnerable software versions prior to 4.7.0."
}