CVE-2024-35373

Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php...

CVE-2024-35373

Mocodo Mocodo Online version 4.2.6 and below is vulnerable to Remote Code Execution (RCE) . The root cause is improper input validation at the /web/rewrite.php API endpoint, which allows an attacker to inject and execute arbitrary code. The vulnerability is classified under CWE-75 (Special Elemen...

Mocodo 安全漏洞

Mocodo is an open source software from Mocodo to help teach and learn about the fundamentals of knowledge. A security vulnerability exists in Mocodo 4.2.6 and earlier versions that stems from vulnerability to remote code execution via /web/rewrite.php...

Mocodo 安全漏洞

Mocodo is an open source software from Mocodo to help teach and learn about the fundamentals of knowledge. A security vulnerability exists in Mocodo 4.2.6 and earlier versions that stems from an inability to properly clean sqlcase input fields, allowing remote attackers to execute arbitrary SQL...

PT-2024-26466 · Mocodo · Mocodo Online

Name of the Vulnerable Software and Affected Versions: Mocodo Mocodo Online versions 4.2.6 and below Description: The issue allows for Remote Code Execution via the "/web/rewrite.php" API endpoint. Recommendations: For versions 4.2.6 and below, as a temporary workaround, consider restricting acce...

PT-2024-26467

Name of the Vulnerable Software and Affected Versions Mocodo Mocodo Online versions 4.2.6 and below Description The issue arises from improper sanitization of the sql case input field in the /web/generate.php endpoint, allowing remote attackers to execute arbitrary SQL commands and potentially...

CVE-2024-35373: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php...

CVE-2024-35374: Improper Neutralization of Special Elements used in a Command

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution RCE under certain conditions...