Published: 02/12/2010 Updated: 10/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The default configuration of Pandora FMS 3.1 and previous versions specifies an empty string for the loginhash_pwd field, which allows remote malicious users to bypass authentication by sending a request to index.php with "admin" in the loginhash_user parameter, in conjunction with the md5 hash of "admin" in the loginhash_data parameter.

Vulnerable Product	Search on Vulmon	Subscribe to Product
artica pandora fms 3.1
artica pandora fms 3.0
artica pandora fms 2.0
artica pandora fms 2.1.1
artica pandora fms 1.3.1
artica pandora fms 1.3
artica pandora fms 2.1
artica pandora fms 1.2
artica pandora fms

Pandora FMS versions 31 and below suffer from authentication bypass, os command injection, remote SQL injection, remote file inclusion and path traversal vulnerabilities ...

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info={}) super(updat ...

[+] Introduction Pandora FMS (for Pandora Flexible Monitoring System) is a software solution for monitoring computer networks It allows monitoring in a visual way the status and performance of several parameters from different operating systems, servers, applications and hardware systems such as firewalls, proxies, databases, web servers or route ...

CWE-287 http://www.securityfocus.com/bid/45112 http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download http://www.exploit-db.com/exploits/15639 http://seclists.org/fulldisclosure/2010/Nov/326 http://osvdb.org/69549 http://secunia.com/advisories/42347 http://packetstormsecurity.com/files/129830/Pandora-3.1-Auth-Bypass-Arbitrary-File-Upload.html https://www.exploit-db.com/exploits/35731/http://www.securityfocus.com/archive/1/514939/100/0/threaded https://nvd.nist.gov https://packetstormsecurity.com/files/96259/Pandora-FMS-Command-Injection-SQL-Injection-Path-Traversal.html https://www.exploit-db.com/exploits/35731/

CVE-2010-4279

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect