CVE-2023-48050
📋 TL;DR
This CVE describes a critical SQL injection vulnerability in the Cams Biometrics Zkteco/eSSL integration module for Odoo HR attendance systems. It allows remote attackers to execute arbitrary SQL commands via the 'db' parameter, potentially leading to full system compromise. Organizations using affected versions of the odoo-biometric-attendance module (v13.0 through 16.0.1) are at risk.
💻 Affected Systems
- Cams Biometrics Zkteco Integration Module
- Cams Biometrics eSSL Integration Module
- odoo-biometric-attendance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover: attacker gains administrative privileges, executes arbitrary code, steals sensitive biometric/HR data, and pivots to other systems.
Likely Case
Data breach and system compromise: attacker extracts sensitive HR/attendance data, modifies database records, and potentially installs backdoors.
If Mitigated
Limited impact with proper network segmentation and input validation, potentially only affecting the biometric module database.
🎯 Exploit Status
Public exploit code exists in the OdZoo repository. The vulnerability requires no authentication and has straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check for official patch from Cams Biometrics/Zkteco/eSSL. 2. If no patch, consider removing or disabling the biometric attendance module. 3. Apply manual code fixes to sanitize the 'db' parameter input.
🔧 Temporary Workarounds
Input Validation Patch
allManually patch the controllers.py file to sanitize the 'db' parameter input
Edit controllers/controllers.py to add proper parameter validation and SQL escaping for the 'db' parameter
Web Application Firewall
allDeploy WAF rules to block SQL injection patterns targeting the biometric module endpoints
Add WAF rules to block SQL injection patterns in requests to /biometric/* endpoints
🧯 If You Can't Patch
- Network segmentation: Isolate the Odoo instance from internet access and restrict internal access to authorized users only.
- Disable the biometric module: Remove or disable the odoo-biometric-attendance module if not critically needed.
🔍 How to Verify
Check if Vulnerable:
Check Odoo installed modules for 'odoo-biometric-attendance' and verify version is between 13.0 and 16.0.1. Examine controllers/controllers.py for lack of input validation on 'db' parameter.Check Version:
In Odoo: Settings → Apps → find 'Biometric Attendance' module and check versionVerify Fix Applied:
Verify the 'db' parameter in controllers.py now uses parameterized queries or proper input sanitization. Test with SQL injection payloads that should be rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in Odoo logs
- Multiple failed login attempts followed by successful biometric module access
- Unexpected database operations from biometric endpoints
Network Indicators:
- SQL injection patterns in HTTP requests to /biometric/* endpoints
- Unusual outbound connections from Odoo server post-exploitation
SIEM Query:
source="odoo.log" AND ("SELECT" OR "UNION" OR "INSERT" OR "UPDATE" OR "DELETE") AND "/biometric/"