CVE-2024-34534

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-06 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote attacker to gain privileges via the data parameter to models/ir_model.py:IrModel::chech_model.

Affected products

Odoo: from 16.0 before 16.0.1 — fixed in 16.0.1

How to fix

Upgrade to a fixed version: Odoo 16.0.1. Check the vendor advisory for mitigations.

References

https://github.com/luvsn/OdZoo/tree/main/exploits/text_commander
https://github.com/luvsn/OdZoo/tree/main/exploits/text_commander

Get alerted when CVE-2024-34534 or the next vulnerability affects your stack