CVE-2018-11222

HIGH EXPLOITED NUCLEI

Artica Pandora FMS <= 7.23 - Local File Inclusion via AJAX Endpoint

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-11222 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.

Nuclei Templates (1)

Pandora FMS <=7.0NG.722 - Remote Code Execution
HIGHVERIFIEDby iamnoooob,rootxharsh,pdresearch
Shodan: http.html:"pandora fms - installation wizard" || http.title:"pandora fms"
FOFA: body="pandora fms - installation wizard" || title="pandora fms"

References (2)

Core 2
Core References
Exploit, Vendor Advisory x_refsource_confirm
https://pandorafms.com/wp-content/uploads/2018/06/whats-new-723-EN.pdf
Third Party Advisory x_refsource_misc
https://blog.hackercat.ninja/post/pandoras_box/

Scores

CVSS v3 7.5
EPSS 0.0562
EPSS Percentile 91.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2023-11-26
CWE
CWE-20
Status published
Products (1)
artica/pandora_fms < 7.23
Published Jun 16, 2018
Tracked Since Feb 18, 2026