CVE-2019-20224

HIGH NUCLEI

Artica Pandora Fms - OS Command Injection

Title source: rule

Description

netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.

Exploits (1)

nomisec WORKING POC 14 stars
by mhaskar · poc
https://github.com/mhaskar/CVE-2019-20224

Nuclei Templates (1)

Pandora FMS 7.0NG - Remote Command Injection
HIGHby ritikchaddha
Shodan: http.title:"pandora fms"
FOFA: title="pandora fms"

References (5)

Scores

CVSS v3 8.8
EPSS 0.9361
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
artica/pandora_fms 7.0_ng
Published Jan 09, 2020
Tracked Since Feb 18, 2026