Description

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T14:17:38.897Z",
  "pubdate": "2026-08-19T14:17:38.897Z",
  "executiveSummary": "An Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability has been identified in Dell OpenManage Enterprise in versions prior to 4.7.0.\nThis vulnerability allows an authenticated attacker with low privileges and remote network access to execute malicious SQL commands within the underlying database context.\nSuccessful exploitation of this flaw can lead to script injection, compromising the integrity, confidentiality, and availability of the affected management platform.\nThe risk implications are severe, as Dell OpenManage Enterprise functions as a centralized infrastructure management console, potentially granting unauthorized access to managed servers and sensitive operational data.\nExploitation requires the attacker to possess low-privilege user credentials and remote network connectivity to the vulnerable application interface.\nOrganizations utilizing Dell OpenManage Enterprise must apply the official vendor patches to remediate the underlying database query construction flaws.",
  "technicalDetails": "The vulnerability resides in the database query handling mechanism of Dell OpenManage Enterprise in versions prior to 4.7.0, specifically stemming from the improper neutralization of special elements used in SQL commands.\nThe root cause is the failure of the application to properly sanitize, validate, or parameterize user-supplied input before incorporating it into dynamic SQL queries executed by the backend database management system.\nBecause input filtering or parameterized queries are inadequately implemented, an attacker can manipulate query logic by injecting malicious SQL syntax through vulnerable input fields or parameters.\nTo execute the attack, a remote adversary must first authenticate to the application using low-privileged credentials.\nOnce authenticated, the attacker interacts with vulnerable application endpoints that accept parameters tied to database operations, supplying a crafted payload containing malicious SQL structures.\nThe backend database processes the modified query string, allowing the attacker to alter the intended database logic.\nIn this specific context, the successful injection of SQL commands facilitates secondary impacts such as script injection, wherein malicious scripts (e.g., JavaScript) can be introduced or reflected through database storage and retrieval mechanisms.\nThe attack vector is network-based, leveraging the web management interface exposed by Dell OpenManage Enterprise.\nThe required privilege level is low, meaning any standard, unprivileged user account created within the application can potentially trigger the vulnerability.\nPost-exploitation impact includes unauthorized data manipulation, potential execution of arbitrary scripts within the user session context, and broader compromise of the enterprise management architecture."
}