CVE-2024-35374: SQL Injection Vulnerability in Mocodo
Summary
CVE-2024-35374: Mocodo vulnerable to SQL injection in /web/generate.php. Affects mocodo versions < 4.2.7. Fixed in 4.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Mocodo is an open-source package available on PyPI that provides a web-based interface for generating SQL schemas from textual descriptions. It is commonly used by developers and database administrators to simplify the process of creating database schemas. However, versions 4.2.6 and below of Mocodo are vulnerable to a SQL injection attack in the /web/generate.php file. This vulnerability arises due to improper sanitization of the sql_case input field, allowing remote attackers to execute arbitrary SQL commands. Exploiting this vulnerability can potentially lead to command injection and remote code execution (RCE) under certain conditions.
Vulnerability Detail
The SQL injection vulnerability in Mocodo allows an attacker to manipulate the sql_case input field in the /web/generate.php file. By injecting malicious SQL commands, an attacker can execute arbitrary code on the server. This can result in unauthorized access to sensitive data, modification or deletion of data, and even complete compromise of the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Latest published version: 4.3.3 as of 23 Oct 2026
pip install --upgrade "mocodo==4.3.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.7
This is the first release that contains the fix.
pip install --upgrade "mocodo==4.2.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a temporary workaround by manually sanitizing the sql_case input field in the /web/generate.php file. This can be done by using appropriate input validation and parameter binding techniques to prevent SQL injection attacks. Here is an example of how the code can be modified:
// Original vulnerable code
$sql_case = $_POST['sql_case'];
// Modified code with input validation
$sql_case = mysqli_real_escape_string($conn, $_POST['sql_case']);
Conclusion
In conclusion, Mocodo versions 4.2.6 and below are vulnerable to a critical SQL injection vulnerability in the /web/generate.php file. This vulnerability allows remote attackers to execute arbitrary SQL commands and potentially achieve remote code execution. Users are strongly advised to upgrade to version 4.2.7 or above to mitigate this vulnerability. If immediate upgrade is not possible, implementing proper input validation and parameter binding techniques can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mocodo →
FAQ
Mocodo is an open-source package that provides a web-based interface for generating SQL schemas from textual descriptions. It simplifies the process of creating database schemas and is commonly used by developers and database administrators.
Exploiting this vulnerability can lead to unauthorized access to sensitive data, modification or deletion of data, and even complete compromise of the affected system. It allows remote attackers to execute arbitrary SQL commands and potentially achieve remote code execution (RCE) under certain conditions.
To fix this vulnerability, it is recommended to upgrade to version 4.2.7 or above of Mocodo. This version includes proper sanitization of the sql_case input field, preventing SQL injection attacks. Users can update their installation by running the command pip install --upgrade mocodo.
If upgrading to the latest version is not immediately feasible, users can implement a temporary workaround by manually sanitizing the sql_case input field in the /web/generate.php file. This can be done by using appropriate input validation and parameter binding techniques to prevent SQL injection attacks.
This vulnerability is rated as CRITICAL with a CVSS score of 9.8, indicating its high severity. It is crucial to address this vulnerability promptly to prevent potential exploitation and compromise of the affected system.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
