Pandora FMS (id_agent) - SQL Injection Vulnerability

Document Title: =============== Pandora FMS idagent - SQL Injection Vulnerability References Source: ==================== OSVDB-ID: 61222 http://osvdb.org/show/osvdb/61222 EDB-ID: 10570 http://www.exploit-db.com/exploits/10570/ PID: 84127...

Pandora FMS 3.2.1 Cross Site Request Forgery

Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested on: v = Pandora XSRF exploit Click submit input...

Pandora Fms 3.2.1 - Cross-Site Request Forgery

Pandora Fms 3.2.1 - Cross-Site Request Forgery Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested...

Pandora FMS v3.2.1 Cross Site Request Forgery

Exploit for php platform in category web applications Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1...

Pandora Fms 3.2.1 - Cross-Site Request Forgery

Exploit Title: Pandora FMS v3.2.1 Cross Site Request Forgery Google Dork: intitle:"Pandora FMS - the Flexible Monitoring System" intext:"Your IP" Date: 12-07-2011 Author: Mehdi Boukazoula Software Link: http://pandorafms.org/ Version: v 3.2.1 Tested on: v = Pandora XSRF exploit Click submit input...

CVE-2011-0612

Adobe Flash Media Server (FMS) is affected by CVE-2011-0612: versions before 3.5.6 and 4.x before 4.0.2 are vulnerable to a remote denial-of-service via XML data corruption. The available sources describe the vulnerability and cite APSB11-11 as the mitigation/patch guidance from Adobe. The OpenVA...

Pandora FMS Console Default Credentials

It is possible to log into the remote Pandora FMS console by providing the default credentials admin / pandora. A remote attacker can exploit this to gain administrative control of the Pandora FMS installation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2010-4280

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

Authentication flaw

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the...

CVE-2010-4281

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : colon character...

CVE-2010-4279

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the...

CVE-2010-4282

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

CVE-2010-4283

PHP remote file inclusion vulnerability in extras/pandoradiag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv1 parameter...

Sql injection

Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via 1 the idgroup parameter in an operation/agentes/veragente action to ajax.php or 2 the groupid parameter in an operation/agentes/estadoagente action to index.ph...

Remote file inclusion

PHP remote file inclusion vulnerability in extras/pandoradiag.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code via a URL in the argv1 parameter...

Design/Logic Flaw

Incomplete blacklist vulnerability in the safeurlextraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : colon character...

Directory traversal

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

CVE-2010-4278

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php...

Code injection

operation/agentes/networkmap.php in Pandora FMS before 3.1.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the layout parameter in an operation/agentes/networkmap action to index.php...

CVE-2010-4279

The default configuration of Pandora FMS 3.1 and earlier specifies an empty string for the loginhashpwd field, which allows remote attackers to bypass authentication by sending a request to index.php with "admin" in the loginhashuser parameter, in conjunction with the md5 hash of "admin" in the...