An authenticated SQL injection vulnerability in OCS Inventory NG Ocsreports allows attackers with operator privileges to potentially compromise sensitive database information.

This is a SQL injection vulnerability (CWE-89) affecting the endpoint /ocsreports/index.php?function=admin_double. An attacker with operator-level authentication can inject malicious SQL commands into the ID field of the selected_grp_dupli parameter, leading to unauthorized data retrieval or modification.

The ability to manipulate SQL queries poses a severe risk to data confidentiality and integrity. With a CVSS score of 8.6, this vulnerability is classified as high, as it enables unauthorized access to critical inventory data stored within the application database. If exploited, an attacker could extract sensitive system information or disrupt inventory management operations.

Immediate Action: Update OCS Inventory NG Ocsreports to version 2.12.6 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Review database audit logs for unusual query patterns or unexpected error messages originating from the Ocsreports module, particularly those involving the admin_double function.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block suspicious SQL syntax within HTTP POST parameters.

Public Exploit Available: Unknown

Given the high severity of this SQL injection flaw, organizations should prioritize updating their OCS Inventory NG instances immediately. Restricting access to the Ocsreports administrative functions to only authorized personnel will further mitigate the risk of exploitation while the update is being staged for deployment.