CVE-2020-35847

This repository contains a functional Python exploit for CVE-2020-35847 and CVE-2020-35848, targeting Cockpit CMS versions before 0.11.2. The exploit demonstrates NoSQL injection to enumerate users, extract password reset tokens, and reset passwords, leveraging the `/auth/resetpassword` and `/auth/newpassword` endpoints.

This exploit demonstrates a NoSQL injection vulnerability in Cockpit CMS 0.11.1, allowing username enumeration and password reset token extraction via crafted JSON payloads. It leverages the `$func` operator to dump user data and reset tokens, then resets the target user's password.

This Metasploit module exploits CVE-2020-35847 and CVE-2020-35846 in Cockpit CMS, chaining NoSQL injection to extract user data and reset tokens, followed by command injection for RCE. It automates user enumeration, password reset, and payload execution without disk writes.