CVE-2020-35848: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2020-12-30T01:15Z
Repository: https://github.com/agentejo/cockpit
Language: PHP
Files changed: modules/Cockpit/Controller/Auth.php
Commit date: 2020-09-14 14:20:51 +0200
Commit message: fix possible security issue for login

Diff: diff --git a/modules/Cockpit/Controller/Auth.php b/modules/Cockpit/Controller/Auth.php
index 99cdd825..b0bbf87f 100755
--- a/modules/Cockpit/Controller/Auth.php
+++ b/modules/Cockpit/Controller/Auth.php
@@ -15,10 +15,14 @@ class Auth extends \LimeExtra\Controller {
 
     public function check() {
 
         if ($data = $this->param('auth')) {
 
+            if (!\is_string($data['user']) || !\is_string($data['password'])) {
+                return ['success' => false, 'error' => 'Pre-condition failed'];
+            }
+
             if (isset($data['user']) && $this->app->helper('utils')->isEmail($data['user'])) {
                 $data['email'] = $data['user'];
                 $data['user']  = '';
             }
 
@@ -126,17 +130,25 @@ class Auth extends \LimeExtra\Controller {
 
     public function newpassword() {
 
         if ($token = $this->param('token')) {
 
+            if (!\is_string($token)) {
+                return false;
+            }
+
             $user = $this->app->storage->findOne('cockpit/accounts', ['_reset_token' => $token]);
 
             if (!$user) {
                 return false;
             }
 
-            $user['md5email'] = md5($user['email']);
+            $user = [
+                'md5email' => md5($user['email']),
+                'user' => $user['name'],
+                'name' => $user['user'],
+            ];
 
             return $this->render('cockpit:views/layouts/newpassword.php', compact('user', 'token'));
         }
 
         return false;
@@ -145,10 +157,14 @@ class Auth extends \LimeExtra\Controller {
 
     public function resetpassword() {
 
         if ($token = $this->param('token')) {
 
+            if (!\is_string($token)) {
+                return false;
+            }
+
             $user = $this->app->storage->findOne('cockpit/accounts', ['_reset_token' => $token]);
             $password = trim($this->param('password'));
 
             if (!$user || !$password) {
                 return false;

Vulnerable code:             $user['md5email'] = md5($user['email']);
Fixed code:             if (!\is_string($data['user']) || !\is_string($data['password'])) {
                return ['success' => false, 'error' => 'Pre-condition failed'];
            }

            if (!\is_string($token)) {
                return false;
            }

            $user = [
                'md5email' => md5($user['email']),
                'user' => $user['name'],
                'name' => $user['user'],
            ];
            if (!\is_string($token)) {
                return false;
            }