Ártica Pandora FMS 7.0

functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.

Published: 2020-02-12T17:52:37.000Z
Updated: 2024-08-04T10:12:10.970Z

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands, you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration, such as defining new alert commands

Published: 2019-12-26T15:59:27.000Z
Updated: 2024-08-05T02:25:12.407Z

Artica Pandora FMS version 7.0 leaks a full installation pathname via GET data when intercepting the main page's graph requisition. This also implies that general OS information is leaked (e.g., a /var/www pathname typically means Linux or UNIX).

Published: 2017-10-27T20:00:00.000Z
Updated: 2024-08-05T20:13:05.924Z

In Artica Pandora FMS version 7.0, an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page, the script will get executed.

Published: 2017-10-27T20:00:00.000Z
Updated: 2024-08-05T20:13:05.860Z

Artica Pandora FMS version 7.0 is vulnerable to remote PHP code execution through the manager files function. This is only exploitable by administrators who upload a PHP file.

Published: 2017-10-27T20:00:00.000Z
Updated: 2024-08-05T20:13:05.926Z