PT-2024-26467 · Mocodo · Mocodo Online

Chocapikk + 1 · CVE-2024-35374 · Published 2024-05-24 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mocodo Mocodo Online versions 4.2.6 and below

Description The issue arises from improper sanitization of the sql case input field in the /web/generate.php endpoint, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, which can lead to remote code execution (RCE) under certain conditions.

Recommendations For versions 4.2.6 and below, consider disabling access to the /web/generate.php endpoint until a proper fix is applied, and ensure that all input fields, especially sql case, are properly sanitized to prevent command injection and RCE.

Exploit

Fix

RCE

Command Injection

SQL injection

Weakness Enumeration

CWE-77

CWE-89

Related Identifiers

CVE-2024-35374

GHSA-J6CV-98JX-MRWR

PYSEC-2026-426

Affected Products

Mocodo Online

References · 18

• 🔥 https://chocapikk.com/posts/2024/mocodo-vulnerabilities · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-426 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j6cv-98jx-mrwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35374 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35374 · Vendor Advisory
• https://github.com/laowantong/mocodo/commit/f9368df28518b6c4a92fd207c260f1978ec34d6e · Note
• https://github.com/laowantong/mocodo/blob/11ca879060a68e06844058cd969c6379214cc2a8/web/generate.php#L104-L158 · Note
• https://github.com/laowantong/mocodo · Note
• https://reddit.com/r/CVEWatch/comments/1nlubrs/top_10_trending_cves_20092025 · Reddit Post
• https://pypi.org/project/mocodo · Note
• https://twitter.com/offsectraining/status/1969017195616432329 · Twitter Post
• https://github.com/advisories/GHSA-j6cv-98jx-mrwr · Note
• https://t.me/cvenotify/81010 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1nmo3h6/top_10_trending_cves_21092025 · Reddit Post
• https://reddit.com/r/CVEWatch/comments/1nniefc/top_10_trending_cves_22092025 · Reddit Post