PT-2020-18753 · Artica · Pandora Fms

Thecybergeek · Published 2020-03-16 · Updated 2022-11-29 · CVE-2020-5844

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pandora FMS version 7.0NG.742 FIX PERL2020

Description The issue allows authenticated administrators to upload malicious PHP scripts and execute them via base64 decoding of the file location. This is achieved through the index.php?sec=godmode/extensions&sec2=extensions/files repo endpoint.

Recommendations For version 7.0NG.742 FIX PERL2020, consider restricting access to the index.php?sec=godmode/extensions&sec2=extensions/files repo endpoint to prevent malicious script uploads until a patch is available. As a temporary workaround, disabling the ability to upload files via this endpoint can minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-5844

Affected Products

Pandora Fms

References · 9

• 🔥 https://github.com/TheCyberGeek/CVE-2020-5844 · Exploit
• 🔥 https://github.com/UNICORDev/exploit-CVE-2020-5844 · Exploit
• 🔥 http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/50961 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-5844 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5844 · Vendor Advisory
• https://t.me/cvenotify/1771 · Telegram Post
• https://t.me/defcon_news/100130 · Telegram Post
• https://pandorafms.com · Note