Mocodo vulnerable to SQL injection in `/web/generate.php`

CRÍTICO 9.8CVE-2024-35374 · GHSA-j6cv-98jx-mrwr · PYSEC-2026-426 · Published 24/05/2024 · updated 17/06/2026

En resumen

CVE-2024-35374 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a mocodo, mocodo online (mocodo).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.8%, mayor que el 86.4% de las vulnerabilidades.
Solución: actualizar a 4.2.7 o posterior.

Package	Affected versions	Patched versions
mocodo PyPI	`< 4.2.7`	`4.2.7`
mocodo online mocodo	`≤ 4.2.6`	No fix yet

Description

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

NVD description

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

References

nvd.nist.gov/vuln/detail/CVE-2024-35374 · ADVISORY
laowantong/mocodo commit f9368df · WEB
chocapikk.com/posts/2024/mocodo-vulnerabilities · WEB
laowantong/mocodo · PACKAGE
laowantong/mocodo · WEB
chocapikk.com/posts/2024/mocodo-vulnerabilities · Exploit
pypi.org/project/mocodo · PACKAGE
GitHub Advisory GHSA-j6cv-98jx-mrwr · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free