Artica Pandora FMS

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Command Injection in Netflow path

A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.

Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.

Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter.

Remote Code Execution leads to Command Injection

System command injection through Netflow function

OS Command injection in Ajax PHP files through HTTP Request

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Traversal Path on PHP file

Unauthenticated Admin Account Takeover Via Cron Log File Backups

Unauth Time-Based SQL Injection

SQL Injection in Graph Container Parameter

Unauth Time-Based SQL Injection via API

OS Command Injection

Linux Local Privilege Escalation Via GoTTY Page

Insecure Default Initialization in API Authentication leads to Authentication Bypass

netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.

functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands

Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file.

QuickShell Authenticated Command Injection

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

OS Command Injection in Network Report leads to Remote Code Execution

Remote Code Execution via File Uploader

Uploading executables via the file manager

SQL Injection in Custom Fields leads to Database Compromise

SQL Injection in Module Search leads to Database Compromise

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Cross-Site Request Forgery on Extension Pages

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Arbitrary File Read As Root Via GoTTY Page

Lack of Authorization and Stored XSS Via Translation Abuse

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Misassignment of privileges can cause DOS attack

Session Fixation in Authentication leads to Session Hijacking

Unauthenticated Admin Account Takeover Via XSS

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.