CVE-2020-5844 - index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location

Back Back to CVE browser

HIGH

index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location

Published Mar 16, 2020

7.2

HIGH

CVSS 3.1

EPSS 30.25%

Description

index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. This affects v7.0NG.742_FIX_PERL2020.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (4)

http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26998
Advisory
https://github.com/TheCyberGeek/CVE-2020-5844
x_refsource_MISCExploitThird Party Advisory
https://pandorafms.com
x_refsource_MISCProduct

Link	Providers	Tags
http://packetstormsecurity.com/files/167503/Pandora-FMS-7.0NG.742-Remote-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26998		Advisory
https://github.com/TheCyberGeek/CVE-2020-5844		x_refsource_MISCExploitThird Party Advisory
https://pandorafms.com		x_refsource_MISCProduct