CVE-2023-40955

Vulnerability

A SQL injection vulnerability exists in the models/base_client.py component of Didotech srl Engineering & Lifecycle Management (pdm) versions 14.0, 15.0, and 16.0 [1]. The pml_config_settings::getQueryRes method passes an attacker-controlled select parameter into an SQL query without proper sanitization, allowing injection of arbitrary SQL statements [1]. The issue was fixed in versions pdm-14.0.1.0.0, pdm-15.0.1.0.0, and pdm-16.0.1.0.0 [1].

Exploitation

An authenticated attacker (portal or internal user) on an Odoo instance with the pdm module installed can trigger the vulnerable getQueryRes method via the External API (XML-RPC) [1]. By passing a crafted select parameter containing an SQL query, the attacker can inject arbitrary SQL into the executed query [1]. No special privileges beyond regular user authentication are required; a portal user without access to Inventory or Manufacturing modules can still successfully exploit this flaw [1].

Impact

Successful exploitation allows a remote authenticated attacker to execute arbitrary SQL commands, leading to privilege escalation and information disclosure [1]. The attacker can bypass intended access controls and read or modify sensitive data from the underlying database. The vendor advisory indicates this can rise to arbitrary code execution [1].

Mitigation

All affected versions should be upgraded to the fixed releases: pdm-14.0.1.0.0, pdm-15.0.1.0.0, or pdm-16.0.1.0.0 [1]. The patch has been made available by the vendor prior to public disclosure [1]. No workarounds are documented; applying the update is the only recommended mitigation.