CVE-2023-48049
Description
A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v. 13.0 through 13.0.1.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the name parameter in controllers/main.py component.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Cybrosys Techno Solutions/Website Blog Searchdescription
- Range: >=13.0, <=13.0.1.0.1
Patches
Vulnerability mechanics
Root cause
"Missing input validation and lack of parameterized queries in the search_contents controller method allow SQL injection via the name parameter."
Attack vector
A remote attacker sends an HTTP POST request to the `/blog/search/` route with a crafted `name` parameter containing SQL injection payloads [ref_id=1]. The controller does not require authentication, so any unauthenticated attacker can reach the endpoint [ref_id=1]. Because the database cursor is used directly, no access rights checking is performed, and no input validation or sanitization is applied, allowing arbitrary SQL injection [ref_id=1].
Affected code
The vulnerable endpoint is the `search_contents` method in `controllers/main.py` of the `website_search_blog` module [ref_id=1]. The `name` parameter is passed directly into a SQL query executed via the database cursor without sanitization or parameterization [ref_id=1].
What the fix does
No official patch is provided in the bundle. The advisory suggests that a possible fix would be to use prepared statements to safely handle user-supplied input [ref_id=1]. Proper input validation and sanitization of the `name` parameter, combined with parameterized queries, would prevent SQL injection by ensuring user input is never concatenated directly into SQL statements [ref_id=1].
Preconditions
- configThe Odoo instance must have the website_search_blog module installed.
- authNo authentication is required; the endpoint is publicly accessible.
- networkThe attacker must be able to send HTTP POST requests to the /blog/search/ route.
- inputThe attacker supplies a crafted name parameter containing SQL injection payload.
Reproduction
Send an HTTP POST request to `/blog/search/` with a body containing a crafted `name` parameter, for example: `name=dev'; UPDATE res_users SET password='whatever' WHERE login='admin'; select id as res_id, name as name, name as value from blog_post where name ILIKE 'dev` [ref_id=1]. This payload demonstrates privilege escalation by updating the admin user's password [ref_id=1].
Generated on May 24, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1News mentions
0No linked articles in our index yet.