Description

Pandora FMS v7.0NG.759 allows improper authorization in User Management where any authenticated user with access to the User Management module could create, modify, delete any user with full admin privilege. The impact could lead to vertical privilege escalation to access the privileges of a higher-level user or typically an admin user.

Proof of Concept

Affected endpoints:

1 POST http://$HOST/pandora_console/index.php?sec=gusuarios&sec2=godmode/users/configure_user&pure=0
2 POST http://$HOST/pandora_console/index.php?sec=gusuarios&sec2=godmode/users/user_list&pure=0
.

PoC image:

Modify own account to admin privilege
Create new account with admin privilege
Delete existing admin