Mocodo vulnerable to SQL injection in `/web/generate.php`

CRITICAL 9.8CVE-2024-35374 · GHSA-j6cv-98jx-mrwr · PYSEC-2026-426 · Published 24/05/2024 · updated 17/06/2026

In short

CVE-2024-35374 is a CRITICAL (CVSS 9.8) vulnerability affecting mocodo, mocodo online (mocodo).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.4% of all vulnerabilities.
Fix: update to 4.2.7 or later.

Package	Affected versions	Patched versions
mocodo PyPI	`< 4.2.7`	`4.2.7`
mocodo online mocodo	`≤ 4.2.6`	No fix yet

Description

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

NVD description

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

References

nvd.nist.gov/vuln/detail/CVE-2024-35374 · ADVISORY
laowantong/mocodo commit f9368df · WEB
chocapikk.com/posts/2024/mocodo-vulnerabilities · WEB
laowantong/mocodo · PACKAGE
laowantong/mocodo · WEB
chocapikk.com/posts/2024/mocodo-vulnerabilities · Exploit
pypi.org/project/mocodo · PACKAGE
GitHub Advisory GHSA-j6cv-98jx-mrwr · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free