.. / CVE-2020-35848

• SQLi
• Nuclei
• Web

Exploit for Agentejo Cockpit <0.12.0 - NoSQL Injection (CVE-2020-35848)

Description:

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form.

Nuclei Template

View the template here CVE-2020-35848.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2020/CVE-2020-35848.yaml

References: