CVEs-PoC/2020/CVE-2020-35847.md

CVE-2020-35847

Description

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

POC

Reference

• http://packetstormsecurity.com/files/162282/Cockpit-CMS-0.11.1-NoSQL-Injection-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/163762/Cockpit-CMS-0.11.1-NoSQL-Injection.html

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/Konstantinos-Papanagnou/CMSpit
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/w33vils/CVE-2020-35847_CVE-2020-35848
• https://github.com/zmylml/yangzifun