CVE-2024-34534

The vulnerability is a SQL injection in the IrModel::check_model method of the Text Commander module (text_commander) for Odoo 16.0 through 16.0.1 [1]. The data parameter is unsanitized and directly used in SQL queries, allowing an attacker to inject arbitrary SQL commands.

An attacker with portal or internal user access to an Odoo instance can trigger the check_model method via the External API (XML-RPC) by passing a crafted data argument [1]. No special privileges are required beyond a valid user account with access to the API.

Successful exploitation allows the attacker to execute arbitrary SQL queries, leading to privilege escalation (e.g., changing the admin password) and information disclosure [1]. The PoC demonstrates changing the admin password to 'a', effectively taking over the administrator account.

No official patch is mentioned in the reference; however, the vulnerability was disclosed responsibly. Users should update the module if a fix becomes available or consider disabling the module if not needed [1].