CVE-2010-4280
Description
Multiple SQL injection vulnerabilities in Pandora FMS before 3.1.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the id_group parameter in an operation/agentes/ver_agente action to ajax.php or (2) the group_id parameter in an operation/agentes/estado_agente action to index.php, related to operation/agentes/estado_agente.php.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| artica | pandora_fms | {"endIncluding":"3.1"} | |
| artica | pandora_fms | 1.2 | |
| artica | pandora_fms | 1.3 | |
| artica | pandora_fms | 1.3.1 | |
| artica | pandora_fms | 2.0 | |
| artica | pandora_fms | 2.1 | |
| artica | pandora_fms | 2.1.1 | |
| artica | pandora_fms | 3.0 | |
| artica | pandora_fms | 3.1 | |
References
- http://osvdb.org/69547
- http://osvdb.org/69548
- http://seclists.org/fulldisclosure/2010/Nov/326
- http://secunia.com/advisories/42347
- http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download
- http://www.exploit-db.com/exploits/15641
- http://www.exploit-db.com/exploits/15642
- http://www.securityfocus.com/archive/1/514939/100/0/threaded
- http://www.securityfocus.com/bid/45112
- http://osvdb.org/69547
- http://osvdb.org/69548
- http://seclists.org/fulldisclosure/2010/Nov/326
- http://secunia.com/advisories/42347
- http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/download
- http://www.exploit-db.com/exploits/15641
- http://www.exploit-db.com/exploits/15642
- http://www.securityfocus.com/archive/1/514939/100/0/threaded
- http://www.securityfocus.com/bid/45112
CWEs
CWE-89
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.