CVE-2020-13854

CVE-2020-13854 affects Pandora FMS (notably 7.44) and enables privilege escalation via the Quick Shell plugin using Gotty running as root. The advisory explains a chain where remote code execution vulnerabilities (e.g., 7.1–7.3) or Web UI flaws grant a low-privilege user a shell on the underlying...

CVE-2020-13855

Artica Pandora FMS 7.44 allows arbitrary file upload leading to remote command execution via the File Repository Manager feature...

CVE-2020-13855

Pandora FMS 7.44 is affected by CVE-2020-13855 (File Repository Manager) which allows an administrator to upload a PHP web shell to a publicly accessible folder, enabling execution of system commands with the apache user. The vulnerability is demonstrated via an uploaded web shell and subsequent ...

CVE-2020-13850

Pandora FMS (Artica Pandora FMS) 7.44 contains an inadequate access control flaw in the Pandora Console web folder (CVE-2020-13850) that enables directory listing and exposure of sensitive files (e.g., logs and uploaded content) via direct URLs such as /pandora_console/*. The CoreLabs advisory do...

CVE-2020-13850

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

CVE-2020-13852: Unrestricted Upload of File with Dangerous Type

Artica Pandora FMS 7.44 allows arbitrary file upload leading to remote command execution via the File Manager feature...

CVE-2020-13853: Improper Neutralization of Input During Web Page Generation

Artica Pandora FMS 7.44 has persistent XSS in the Messages feature...

CVE-2020-13855: Unrestricted Upload of File with Dangerous Type

Artica Pandora FMS 7.44 allows arbitrary file upload leading to remote command execution via the File Repository Manager feature...

CVE-2020-13851: Improper Neutralization of Special Elements used in an OS Command

Artica Pandora FMS 7.44 allows remote command execution via the events feature...

CVE-2020-13854: Improper Privilege Management

Artica Pandora FMS 7.44 allows privilege escalation...

CVE-2020-13850: Direct Request

Artica Pandora FMS 7.44 has inadequate access controls on a web folder...

: Pandora FMS Community Multiple Vulnerabilities

1. Advisory Information Title : Pandora FMS Community Multiple Vulnerabilities Advisory ID : CORE-2020-0010 Advisory URL : www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities Date published : 2020-06-09 Date of last update : 2020-06-09 Vendors contacted: Ártic...

Pandora FMS Events Remote Command Execution

This module exploits a vulnerability CVE-2020-13851 in Pandora FMS versions 7.0 NG 742, 7.0 NG 743, and 7.0 NG 744 and perhaps older versions in order to execute arbitrary commands. This module takes advantage of a command injection vulnerability in the Events feature of Pandora FMS. This flaw...

Pandora FMS Remote Code Execution (CVE-2020-5844)

A remote code execution vulnerability exists in Pandora FMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Pandora FMS - Ping Authenticated Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pandora FMS Ping Authenticated Remote Code Execution', 'Description' = %q This module exploits a vulnerability found in Pandora FMS 7.0NG and...

Pandora FMS Ping Authenticated Remote Code Execution Exploit

This Metasploit module exploits a vulnerability found in Pandora FMS 7.0NG and lower. nettools.php in Pandora FMS 7.0NG allows remote attackers to execute arbitrary OS commands. This module requires Metasploit: https://metasploit.com/download Current source:...

Pandora FMS Ping Authenticated Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Pandora FMS Ping Authenticated Remote Code Execution', 'Description' = %q This module exploits a vulnerability found in Pandora FMS 7.0NG and...

Pandora FMS 7.0NG - (net_tools.php) Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Pandora FMS 7.0NG - 'nettools.php' Remote Code Execution Build: PC170324 - MR 0 Exploit Author: Basim Alabdullah Vendor homepage: http://pandorafms.org/ Version: 7.0 Software link:...

Pandora FMS 7.0NG - 'net_tools.php' Remote Code Execution

Exploit Title: Pandora FMS 7.0NG - 'nettools.php' Remote Code Execution Build: PC170324 - MR 0 Date: 2020-03-30 Exploit Author: Basim Alabdullah Vendor homepage: http://pandorafms.org/ Version: 7.0 Software link: https://pandorafms.org/features/free-download-monitoring-software/ Tested on: CentOS...

Artica Pandora FMS Information Disclosure Vulnerability (CNVD-2020-20720)

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS 7.42 and earlier versions. An attacker can exploit the vulnerability...