GHSA-j6cv-98jx-mrwr

Mocodo vulnerable to SQL injection in `/web/generate.php`

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-35374

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mocodo	< 4.2.7	4.2.7

Details

As written in the advisory (Markdown source, shown as plain text).

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the `sql_case` input field in `/web/generate.php`, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-35374 advisory
https://github.com/laowantong/mocodo/commit/f9368df28518b6c4a92fd207c260f1978ec34d6e web
https://chocapikk.com/posts/2024/mocodo-vulnerabilities web
https://github.com/laowantong/mocodo package
https://github.com/laowantong/mocodo/blob/11ca879060a68e06844058cd969c6379214cc2a8/web/generate.php#L104-L158 web