CVE-2020-35847

Related Files

Cockpit CMS 0.11.1 NoSQL Injection

Posted Aug 10, 2021

Authored by Brian Ombongi

Cockpit CMS version 0.11.1 username enumeration and password reset NoSQL injection exploit.

tags | exploit, sql injection

advisories | CVE-2020-35847, CVE-2020-35848

SHA-256 | 6debd598ed60fd7113eefa3dd16534a89ff8de59b195a5d4f144f59fa41618bb

Download | Favorite | View

Cockpit CMS 0.11.1 NoSQL Injection / Remote Command Execution

Posted Apr 21, 2021

Authored by h00die, Nikita Petrov | Site metasploit.com

This Metasploit module exploits two NoSQL injection vulnerabilities to retrieve the user list and password reset tokens from the system. Next, the USER is targeted to reset their password. Then, a command injection vulnerability is used to execute the payload. While it is possible to upload a payload and execute it, the command injection provides a no disk write method which is more stealthy. Cockpit CMS versions 0.10.0 through 0.11.1, inclusive, contain all the necessary vulnerabilities for exploitation.

tags | exploit, vulnerability, sql injection

advisories | CVE-2020-35846, CVE-2020-35847

SHA-256 | 4d68ac3e666ed9ff71dca71ddb5b25a40d4998c467a0dc4dc723c054ae9043cc

Download | Favorite | View