A SQL injection vulnerability in Cockpit CMS allows attackers with read-only API access to bypass content filters and extract sensitive data from the underlying database.

This is a SQL injection flaw (CWE-89) located in the MongoLite Aggregation Optimizer. An attacker with a valid read-only API key can trigger the vulnerability by sending crafted requests to the /api/content/aggregate/{model} endpoint.

The ability for a low-privileged, read-only user to extract unauthorized data from the content database poses a significant risk to data confidentiality. Given the CVSS score of 7.7, this is classified as a High severity issue. Successful exploitation could lead to the exposure of unpublished content, sensitive user information, or proprietary business data, resulting in potential regulatory non-compliance and reputational damage.

Immediate Action: Update Cockpit to version 2.13.5 or later to apply the necessary sanitization logic in the Aggregation Optimizer.

Proactive Monitoring: Monitor API access logs for anomalous requests to the /api/content/aggregate/ endpoint, particularly those involving unusual characters or SQL syntax in field parameters.

Compensating Controls: Restrict access to the /api/content/aggregate/ endpoint via a Web Application Firewall (WAF) or by implementing strict network-level access controls to ensure only trusted clients can communicate with the API.

Public Exploit Available: Yes, a public proof-of-concept exists via a GitHub repository.

The presence of a public proof-of-concept increases the likelihood of exploitation by threat actors. Organizations utilizing Cockpit CMS must prioritize upgrading to version 2.13.5 immediately. If an immediate update is not feasible, restrict API access to the affected endpoint to mitigate the risk of unauthorized data extraction.