vendor:
Pandora FMS
by:
Juan Galiana Lara
8.5/10
CVSS
SQL Injection
89
CWE
Product Name: Pandora FMS
Affected Version From: Pandora FMS
Affected Version To: Pandora FMS
Patch Exists: NO
Related CWE: CVE-2010-4280
CPE: a:pandorafms:pandora_fms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux, Windows, Mac
2010
Blind SQL Injection – CVE-2010-4280
The parameter group_id of operation/agentes/estado_agente.php is vulnerable to blind sql injection. An attacker can exploit this vulnerability to gain access to the system by using a malicious URL.
Mitigation:
The user should ensure that the application is not vulnerable to SQL injection attacks by validating all user input and using parameterized queries.