SQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module with HR Attendance (aka odoo-biometric-attendance) v. 13.0 through 16.0.1 allows a remote attacker to execute arbitrary code and to gain privileges via the db parameter in the controllers/controllers.py component.
References
| Link | Resource |
|---|---|
| https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance | Third Party Advisory |
Configurations
History
27 Dec 2023, 18:36
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:odoo:biometric_attendance:*:*:*:*:*:*:*:* cpe:2.3:a:camsbiometrics:zkteco\,_essl\,_cams_biometrics_integration_module:*:*:*:*:*:*:*:* |
|
| First Time |
Camsbiometrics
Odoo Camsbiometrics zkteco\, Essl\, Cams Biometrics Integration Module Odoo biometric Attendance |
|
| References | () https://github.com/luvsn/OdZoo/tree/main/exploits/odoo-biometric-attendance - Third Party Advisory |
15 Dec 2023, 13:42
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-15 01:15
Updated : 2024-02-28 20:54
NVD link : CVE-2023-48050
Mitre link : CVE-2023-48050
CVE.ORG link : CVE-2023-48050
JSON object : View
Products Affected
camsbiometrics
- zkteco\,_essl\,_cams_biometrics_integration_module
odoo
- biometric_attendance
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')