CVE-2010-4279

This Metasploit module exploits an authentication bypass (CVE-2010-4279) in Pandora v3.1 by using a hardcoded loginhash to gain admin access, then uploads an arbitrary PHP payload via the built-in file manager to achieve remote code execution.

The document describes an authentication bypass vulnerability (CVE-2010-4279) in Pandora FMS, where an attacker can log in as any user, including admin, by providing a username and its MD5 hash when the default configuration is used.

This Metasploit module exploits an authentication bypass (CVE-2010-4279) in Pandora FMS v3.1, allowing arbitrary file upload and remote code execution via a PHP payload. It bypasses login using a hardcoded hash and uploads a malicious PHP file to the '/images/' directory.