CVE-2024-34533: 
Odoo vulnerability analysis and mitigation

A SQL injection vulnerability has been identified in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) versions 11.0 through 17.x before 17.0.3. The vulnerability was discovered and disclosed in May 2024, affecting the module's query handling components. This security flaw allows remote attackers to gain elevated privileges through SQL injection attacks (GitHub Exploit).

The vulnerability exists in multiple components of the izi_data module, specifically in the IZITools class methods: query_check, query_fetch, and query_execute. The issue stems from insufficient input validation when handling database queries through these methods. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network accessibility with low attack complexity (NVD).

The exploitation of this vulnerability can lead to significant security breaches including privilege escalation and information disclosure. An attacker can execute arbitrary SQL queries through the database cursor, potentially accessing and modifying sensitive data without proper authorization. The vulnerability bypasses normal access rights checking mechanisms, allowing attackers to perform unauthorized database operations (GitHub Exploit).

The vulnerability is exploitable through the External API of Odoo instances with the izi_data module installed. Both portal users and internal users can trigger the vulnerable methods by passing crafted query arguments. A proof-of-concept exploit demonstrates how an attacker can modify administrative passwords and access sensitive information using XML-RPC calls to the affected methods (GitHub Exploit).

The vulnerability has been patched in version 17.0.3 of the izi_data module. Organizations are strongly advised to upgrade to this version or later. Potential mitigation strategies could include implementing prepared statements for database queries or making the affected methods private to prevent calls from the External API (GitHub Exploit).