CVE-2017-10803
MEDIUMOdoo 8.0, 9.0, 10.0 - Authenticated Remote Code Execution via Database Anonymization Unpickle
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-10803. PoCs published by SecuriTeam.
AI-analyzed exploit summary This exploit leverages insecure deserialization in Odoo CRM's Database Anonymization module via a crafted pickle file to achieve arbitrary Python code execution, resulting in a reverse shell. The PoC demonstrates the vulnerability by generating a malicious pickle file that executes a bash reverse shell command.
Description
In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used.
Exploits (1)
This exploit leverages insecure deserialization in Odoo CRM's Database Anonymization module via a crafted pickle file to achieve arbitrary Python code execution, resulting in a reverse shell. The PoC demonstrates the vulnerability by generating a malicious pickle file that executes a bash reverse shell command.
References (1)
Scores
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H