CVE-2023-40956

Vulnerability

CVE-2023-40956 is a SQL injection vulnerability in the Cloudroits Website Job Search module (technical name: odoo_website_job_search) for Odoo version 15.0. The flaw resides in the controllers/main.py file, specifically within the RecruitmentInherit::search_contents(**kw) method. The name parameter in the /job/search/ route is unsafely incorporated into an SQL query, allowing an attacker to inject arbitrary SQL statements. No special configuration is required beyond having the module installed.

Exploitation

An attacker must be a remote authenticated user of an Odoo instance that has the odoo_website_job_search module installed. The attacker sends an HTTP POST request to the /job/search/ endpoint with a crafted name parameter that contains an SQL injection payload. For example, the PoC in reference [1] demonstrates: "name": "dev'; UPDATE res_users SET password='whatever' WHERE login='admin'; select id as res_id, name as name, name as value from hr_job where name ILIKE 'dev". No user interaction beyond the authenticated session is needed. The database cursor executes the injected query.

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands on the Odoo database, leading to privilege escalation (e.g., changing the admin password) and information disclosure. The attacker can achieve full control over user credentials and sensitive data stored in the database. The scope of compromise is the entire Odoo instance and its data.

Mitigation

A patch has been made available by the module's vendor before the public disclosure of this vulnerability, according to reference [1]. Users should update the odoo_website_job_search module to the latest patched version from the Odoo Apps Store. If no patch has been applied, administrators should disable the module or restrict access to the /job/search/ endpoint until an update is applied. No known KEV listing exists for this CVE.