CVE-2020-35848
CRITICAL NUCLEIAgentejo Cockpit < 0.11.2 - NoSQL Injection via Auth Controller New Password Function
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-35848. PoCs published by Brian Ombongi, sabbu143s. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates NoSQL injection in Cockpit CMS 0.11.1 to enumerate users, extract password reset tokens, and reset passwords. It leverages the `$func` operator to dump sensitive data via `var_dump`.
Description
Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
Exploits (2)
This exploit demonstrates NoSQL injection in Cockpit CMS 0.11.1 to enumerate users, extract password reset tokens, and reset passwords. It leverages the `$func` operator to dump sensitive data via `var_dump`.
This repository contains a functional exploit for CVE-2020-35848, demonstrating a NoSQL injection vulnerability in Agentejo Cockpit CMS < 0.11.2. The exploit automates username enumeration, token extraction, password reset, and admin login to achieve remote code execution via admin-accessible endpoints.
Nuclei Templates (1)
http.favicon.hash:688609340 || http.html:"cockpit"
icon_hash=688609340 || body="cockpit"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H