CVE-2024-35374

Mocodo vulnerable to SQL injection in `/web/generate.php`

9.8 CriticalFix available

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.77%Up 2.7 points since Feb 14, 2025

What each source reports

CVE List Score used 9.8

Record: CVE-2024-35374
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

EUVDEUVD-2024-1660 9.8

Record: EUVD-2024-1660
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j6cv-98jx-mrwr 9.8

Mocodo vulnerable to SQL injection in `/web/generate.php`

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

Record: GHSA-j6cv-98jx-mrwr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

NVD 9.8

Record: CVE-2024-35374
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

OSVGHSA-j6cv-98jx-mrwr 9.8

Mocodo vulnerable to SQL injection in `/web/generate.php`

Record: GHSA-j6cv-98jx-mrwr
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

OSVPYSEC-2026-426 9.8

Mocodo vulnerable to SQL injection in `/web/generate.php`

Record: PYSEC-2026-426
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

mocodo online

Affected packages

Affected packages
Package	Affected	Fixed
`mocodo` PyPI	through 4.2.6	4.2.7
`mocodo` PyPI	before 4.2.7, plus listed versions 2.0.02.0.0rc12.0.12.0.102.0.11 Show 45 moreShow less 2.0.122.0.132.0.142.0.152.0.162.0.172.0.192.0.22.0.202.0.212.0.32.0.42.0.52.0.62.0.72.0.82.0.92.12.1.22.1.32.1.42.32.3.12.3.22.3.2rc12.3.2rc22.3.32.3.52.3.72.3.82.3.93.03.0.13.0.23.0.33.0.43.0.53.0.63.0.73.0.83.1.03.1.13.1.23.2.03.2.1	4.2.7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-35374 is a critical vulnerability (CVSS 9.8) in Mocodo Online, published May 24, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.77%, the 86th percentile. Fixed in mocodo 4.2.7.

References

This page doesn't list everything

Left out here: 29 versions. The JSON record has them.