CVE-2020-35846

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

Recent assessments:

h00die at May 31, 2021 12:07pm UTC reported:

noSQL injection within the /auth/requestreset API. By sending JSON.generate({ 'user' => { '$func' => 'var_dump' } }) it causes the var_dump function to be called, which dumps all memory for the user object. This, in effect, allows for enumerating all usernames on the system. This can be combined with CVE-2020-35847 to eventually get an RCE.

Assessed Attacker Value: 4
Assessed Attacker Value: 4Assessed Attacker Value: 5