CVE-2024-35374: Mocodo SQL Injection Vulnerability in generate.php
Summary
CVE-2024-35374: Mocodo vulnerable to SQL injection in /web/generate.php. Affects mocodo versions < 4.2.7. Fixed in 4.2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mocodo is an online tool designed for creating entity-relationship diagrams from textual descriptions. It is widely used for database modeling and offers a user-friendly interface for generating visual representations of data structures. However, versions 4.2.6 and below are vulnerable to SQL injection attacks, which can compromise the integrity and security of the application.
Vulnerability Detail
The vulnerability arises from improper sanitization of the 'sql_case' input field in the '/web/generate.php' file of Mocodo. This flaw allows remote attackers to inject arbitrary SQL commands, potentially leading to command injection and remote code execution (RCE) under certain conditions. The implications of this vulnerability are severe, as it could allow attackers to manipulate the database, access sensitive information, or execute malicious code on the server.
How To Fix
Latest published version: 4.3.3 as of 23 Oct 2026
pip install --upgrade "mocodo==4.3.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.7
This is the first release that contains the fix.
pip install --upgrade "mocodo==4.2.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the 'sql_case' input field in the '/web/generate.php' until the package is updated. Additionally, implementing web application firewalls (WAF) or input validation mechanisms can help mitigate the risk of SQL injection attacks.
Conclusion
The SQL injection vulnerability in Mocodo versions 4.2.6 and below poses a significant risk to users. It is crucial to update to version 4.2.7 or later to mitigate this risk. Users are also encouraged to utilize tools like Vulert for real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for mocodo →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to the database, data manipulation, and remote code execution.
Yes, the vulnerability has been patched in version 4.2.7 of Mocodo. Users should upgrade to this version.
If an immediate update is not possible, avoid using the vulnerable input fields and consider implementing additional security measures such as input validation.
