Pandora FMS 'index.php' Insecure Default Password And SQL Injection Vulnerabilities

Bugtraq ID:	71325
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 01 2014 12:00AM
Updated:	Feb 01 2014 12:00AM
Credit:	Jason Kratzer and Lincoln
Vulnerable:	Pandora FMS Team Pandora FMS 4.0.3 Pandora FMS Team Pandora FMS 3.2.1 Pandora FMS Team Pandora FMS 3.1.1 Pandora FMS Team Pandora FMS 5.0 SP2 Pandora FMS Team Pandora FMS 5.0 Pandora FMS Team Pandora FMS 4.1 Pandora FMS Team Pandora FMS 4.0.1 Pandora FMS Team Pandora FMS 4.0 Pandora FMS Team Pandora FMS 3.1 Pandora FMS Team Pandora FMS 3 Pandora FMS Team Pandora FMS 2.1
Not Vulnerable:	Pandora FMS Team Pandora FMS 5.0 SP3

Pandora FMS 'index.php' Insecure Default Password And SQL Injection Vulnerabilities

Pandora FMS is prone to an insecure default-password vulnerability and an SQL injection vulnerability.

Attackers can exploit these issues to gain access to the affected application using the default authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Pandora FMS 5.0 SP2 and prior are vulnerable.

Pandora FMS 'index.php' Insecure Default Password And SQL Injection Vulnerabilities

The following metasploit module is available:

• /data/vulnerabilities/exploits/71325.rb

Pandora FMS 'index.php' Insecure Default Password And SQL Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Pandora FMS 'index.php' Insecure Default Password And SQL Injection Vulnerabilities

References:

• Pandora FMS - Homepage (Pandora FMS Team)
  
• Pandora FMS 5 Service Pack 3 Download Page (Pandora FMS)