CVE-2024-35374

CRITICAL9.8EPSS 8.4%

Mocodo vulnerable to SQL injection in `/web/generate.php`

Published: 5/28/2024Modified: 5/28/2024

Description

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the `sql_case` input field in `/web/generate.php`, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

Affected packages (1)

PyPI/mocodofrom 0, < 4.2.7

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-35374
PATCHhttps://github.com/laowantong/mocodo
WEBhttps://chocapikk.com/posts/2024/mocodo-vulnerabilities
WEBhttps://github.com/laowantong/mocodo/blob/11ca879060a68e06844058cd969c6379214cc2a8/web/generate.php#L104-L158
WEBhttps://github.com/laowantong/mocodo/commit/f9368df28518b6c4a92fd207c260f1978ec34d6e