{"id":"CVE-2024-35374","aliases":["EUVD-2024-1660","GHSA-j6cv-98jx-mrwr","PYSEC-2026-426"],"status":"published","title":"Mocodo vulnerable to SQL injection in `/web/generate.php`","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.02767,"percentile":0.86407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-89"],"published":"2024-05-24T20:29:35Z","modified":"2026-07-13T16:15:28Z","fixes":[{"ecosystem":"PyPI","package":"mocodo","fixed_in":["4.2.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mocodo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.6"},{"fixed":"4.2.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mocodo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}],"versions":["2.0.0","2.0.0rc1","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.19","2.0.2","2.0.20","2.0.21","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1","2.1.2","2.1.3","2.1.4","2.3","2.3.1","2.3.2","2.3.2rc1","2.3.2rc2","2.3.3","2.3.5","2.3.7","2.3.8","2.3.9","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.2","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3b1","4.1.3b2","4.1.3b3","4.1.3b4","4.1.3b5","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6"]},{"source":"osv","ecosystem":"PyPI","package":"mocodo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.7"}]}],"versions":["2.0.0","2.0.0rc1","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.19","2.0.2","2.0.20","2.0.21","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1","2.1.2","2.1.3","2.1.4","2.3","2.3.1","2.3.2","2.3.2rc1","2.3.2rc2","2.3.3","2.3.5","2.3.7","2.3.8","2.3.9","3.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.1.0","3.1.1","3.1.2","3.2.0","3.2.1","4.0.0","4.0.1","4.0.10","4.0.11","4.0.12","4.0.13","4.0.14","4.0.2","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.1.0","4.1.1","4.1.2","4.1.3b1","4.1.3b2","4.1.3b3","4.1.3b4","4.1.3b5","4.2.0","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6"]}],"products":[{"vendor":"mocodo","product":"mocodo_online"}],"references":[{"url":"https://github.com/laowantong/mocodo/blob/11ca879060a68e06844058cd969c6379214cc2a8/web/generate.php#L104-L158","tags":["x_transferred","Product","web"]},{"url":"https://chocapikk.com/posts/2024/mocodo-vulnerabilities/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35374","tags":["advisory"]},{"url":"https://github.com/laowantong/mocodo/commit/f9368df28518b6c4a92fd207c260f1978ec34d6e","tags":["web"]},{"url":"https://chocapikk.com/posts/2024/mocodo-vulnerabilities","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j6cv-98jx-mrwr","tags":["advisory"]},{"url":"https://github.com/laowantong/mocodo","tags":["package"]},{"url":"https://pypi.org/project/mocodo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-35374","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2024-05-24T20:29:35.384Z","modified":"2025-02-13T15:58:36.006Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-1660","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2024-05-24T20:29:35Z","modified":"2025-02-13T15:58:36Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:03:54.170588Z"}],"ghsa":[{"id":"GHSA-j6cv-98jx-mrwr","title":"Mocodo vulnerable to SQL injection in `/web/generate.php`","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the `sql_case` input field in `/web/generate.php`, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2024-05-28T20:20:37Z","modified":"2024-05-28T20:20:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"nvd":[{"id":"CVE-2024-35374","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2024-05-24T21:15:59.793Z","modified":"2026-06-17T07:34:50.34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"GHSA-j6cv-98jx-mrwr","title":"Mocodo vulnerable to SQL injection in `/web/generate.php`","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the `sql_case` input field in `/web/generate.php`, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2024-05-28T20:20:37Z","modified":"2026-06-29T12:26:13.083506026Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"PYSEC-2026-426","title":"Mocodo vulnerable to SQL injection in `/web/generate.php`","description":"Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the `sql_case` input field in `/web/generate.php`, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.","status":"published","published":"2026-06-29T11:50:40.115425Z","modified":"2026-07-13T16:15:28.556127462Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}