Mocodo vulnerable to SQL injection in `/web/generate.php`

2024-05-2820:20:37

Google

osv.dev

mocodo online

sql injection

remote code execution

vulnerability

/web/generate.php

9 High

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

CPENameOperatorVersion
mocodoeq4.2.0
mocodoeq3.0.5
mocodoeq4.1.3b4
mocodoeq4.0.9
mocodoeq4.1.3b1
mocodoeq2.3.3
mocodoeq3.0.1
mocodoeq4.2.2
mocodoeq2.0.7
mocodoeq4.0.0