PT-2020-19857 · Artica · Artica Pandora Fms

Published 2020-03-23 · Updated 2020-03-25 · CVE-2020-7935

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions through 7.42

Description The issue allows for remote PHP code execution due to an Unrestricted Upload Of A File With A Dangerous Type in the File Manager. An attacker, with Administrator access, can create or use an existing directory that is externally accessible to store PHP files, knowing the filename and exact path, thus enabling PHP code execution in the context of the application.

Recommendations For versions through 7.42, as a temporary workaround, consider restricting access to the File Manager to minimize the risk of exploitation. Avoid using the File Manager to upload files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-7935

Affected Products

Artica Pandora Fms

References · 5

• 🔥 https://k4m1ll0.com/cve-2020-7935.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7935 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7935 · Vendor Advisory
• https://t.me/cvenotify/2017 · Telegram Post
• https://t.me/cvenotify/2018 · Telegram Post