CVE-2014-125115

The mobile/index.php endpoint does not sanitize the loginhash_data parameter — user input is directly concatenated into the SQL query, allowing an attacker to extract the administrator password hash or active session tokens. After gaining administrative access, the File Manager component does not verify the MIME type or extension of uploaded files, allowing the upload of any PHP file (web shell) to a publicly accessible directory. Executing the web shell gives the attacker full control over the server.

An attacker can completely compromise the server — gain remote access to the system shell (RCE), read or modify database data, and then use the server as an entry point for further lateral movement in the network.

Pandora FMS should be updated to version 5.0 SP3 or later, in which the described vulnerabilities have been fixed according to the SP3 release document available in the vendor's references. Until the update is applied, access to the Pandora FMS web interface should be restricted to trusted IP addresses only, and access to the mobile/index.php endpoint should be disabled from the public network.

Pandora FMS version 5.0 SP2 and earlier