CVE-2024-34534: 
Odoo vulnerability analysis and mitigation

A SQL injection vulnerability has been identified in Cybrosys Techno Solutions Text Commander module (versions 16.0 through 16.0.1). The vulnerability, tracked as CVE-2024-34534, was discovered on May 6, 2024, and allows remote attackers to gain elevated privileges through the data parameter in the models/ir_model.py:IrModel::check_model function (NVD, OdZoo).

The vulnerability exists in the check_model method of the ir.model component, specifically in models/ir_model.py:IrModel::check_model(data). The issue stems from insufficient input validation of the data parameter, allowing attackers to inject arbitrary SQL queries that are directly executed through the database cursor. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (NVD).

The vulnerability can lead to privilege escalation and information disclosure. Attackers can execute arbitrary SQL queries with consequences ranging from unauthorized access to sensitive data to manipulation of database contents. Since the vulnerable method is public and accessible via the External API, and no access rights checking is performed, the impact is particularly severe (OdZoo).

The vulnerability is exploitable through the External API by both portal users and internal users who have access to an Odoo instance with the text_commander module installed. An attacker can trigger the check_model method by sending an XML-RPC request with a crafted data argument to inject malicious SQL queries. A proof-of-concept exploit has been developed demonstrating the ability to modify admin passwords through SQL injection (OdZoo).

A suggested mitigation approach includes implementing prepared statements for database queries and making the affected method private to prevent calls from the External API. Users should update to a patched version when available or consider implementing additional access controls (OdZoo).