Artica Pandora FMS any version

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhash_pwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Command Injection in Netflow path

Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.

Artica Pandora FMS before 743 allows unauthenticated attackers to conduct SQL injection attacks via the pandora_console/include/chart_generator.php session_id parameter.

Remote Code Execution leads to Command Injection

System command injection through Netflow function

OS Command injection in Ajax PHP files through HTTP Request

Argument Injection Leading to Remote Code Execution in Realtime Graph Extension

Traversal Path on PHP file

Unauthenticated Admin Account Takeover Via Cron Log File Backups

Unauth Time-Based SQL Injection

SQL Injection in Graph Container Parameter

Unauth Time-Based SQL Injection via API

OS Command Injection

Linux Local Privilege Escalation Via GoTTY Page

Insecure Default Initialization in API Authentication leads to Authentication Bypass

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php.

QuickShell Authenticated Command Injection

OS Command Injection in Network Report leads to Remote Code Execution

OS Command Injection in WebServerModuleDebug via Blacklist Bypass leads to Remote Code Execution

Remote Code Execution via File Uploader

Uploading executables via the file manager

SQL Injection in Custom Fields leads to Database Compromise

SQL Injection in Module Search leads to Database Compromise

Server-Side Request Forgery in API Checker leads to Privilege Escalation

Cross-Site Request Forgery on Extension Pages

Unrestricted File Upload in Extension Uploader leads to Remote Code Execution

Arbitrary File Read As Root Via GoTTY Page

Lack of Authorization and Stored XSS Via Translation Abuse

Missing Authorization in Configuration Ajax Endpoint leads to Information Disclosure

Misassignment of privileges can cause DOS attack

Session Fixation in Authentication leads to Session Hijacking

Unauthenticated Admin Account Takeover Via XSS

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via (1) the page parameter to ajax.php or (2) the id parameter to general/pandora_help.php, and allow remote attackers to include and execute, create, modify, or delete arbitrary local files via (3) the layout parameter to operation/agentes/networkmap.php.

Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character.

PHP remote file inclusion vulnerability in extras/pandora_diag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv[1] parameter.

Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php.

OS Command Injection in Event Response Execution

Arbitrary File Read