CVE-2014-125115

🗓️ 25 Jul 2025 15:53:16Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 34 Views🌐 WEB

Unauthenticated SQL injection in Pandora FMS 5.0 SP2 allows credential extraction and RCE.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2014-125115	29 May 201815:50	–	circl
CNNVD	Pandora FMS 安全漏洞	25 Jul 202500:00	–	cnnvd
Cvelist	CVE-2014-125115 Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE	25 Jul 202515:53	–	cvelist
EUVD	EUVD-2014-9806	7 Oct 202500:30	–	euvd
Metasploit	Pandora FMS Default Credential / SQLi Remote Code Execution	1 Feb 201400:00	–	metasploit
NVD	CVE-2014-125115	25 Jul 202516:15	–	nvd
OpenVAS	Pandora FMS < 5.1 SP1 Multiple Vulnerabilities - Active Check	4 Dec 201400:00	–	openvas
Positive Technologies	PT-2025-31206 · Undefined · Undefined	25 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2014-125115	27 Jul 202516:14	–	redhatcve
Vulnrichment	CVE-2014-125115 Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE	25 Jul 202515:53	–	vulnrichment

Vulners

CNA

Node

artica_st pandora_fmsRange0–5.0 sp2

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "index.php",
      "mobile/index.php",
      "godmode/setup/file_manager"
    ],
    "product": "Pandora FMS",
    "vendor": "Artica ST",
    "versions": [
      {
        "lessThanOrEqual": "5.0 SP2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/pandora-fms-default-creds-sqli-rce
web	www.web.archive.org/web/20140331231237/http://pandorafms.com/downloads/whats_new_5-SP3.pdf
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/pandora_fms_sqli.rb
exploit-db	www.exploit-db.com/exploits/35380
web	www.web.archive.org/web/20140304121149/http://blog.pandorafms.org/

Parameter	Position	Path	Description	CWE
login	request body	pandora_console/mobile/index.php	SQL injection via loginhash_data-like flow in mobile login path.	CWE-89
user	request body	pandora_console/mobile/index.php	SQL injection via loginhash_data-like flow in mobile login path.	CWE-89
password	request body	pandora_console/mobile/index.php	SQL injection via loginhash_data-like flow in mobile login path.	CWE-89
input	request body	pandora_console/mobile/index.php	SQL injection via loginhash_data-like flow in mobile login path.	CWE-89
loginhash_data	request body	pandora_console/index.php	SQL injection vulnerability in loginhash_data used to extract credentials.	CWE-89
loginhash_user	request body	pandora_console/index.php	SQL injection vulnerability in loginhash_data used to extract credentials.	CWE-89
loginhash	request body	pandora_console/index.php	SQL injection vulnerability in loginhash_data used to extract credentials.	CWE-89

17 Jun 2026 00:04Current

8.4High risk

Vulners AI Score8.4

CVSS 410

EPSS0.01717

SSVC