Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck
CVE-2021-47704OpenBMCS SQL Injection via obix_test.php
High 8.7
In plain English
A high-severity SQL injection in OpenBMCS from OPEN BMCS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 64.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenBMCS 2.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting arbitrary SQL code. Attackers can send GET requests to /debug/obix_test.php with malicious 'id' values to extract database information.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
References
- ExploitDB-50668 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2022-5692) third-party-advisory
- VulnCheck Advisory: OpenBMCS SQL Injection via obix_test.php third-party-advisory