OpenBMCS 2.4 Authenticated SQL Injection

OpenBMCS suffers from an SQL Injection vulnerability. Input passed via the ‘id’ GET parameter is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.