SQL Injection in Visual Console
CVE-2023-44088

5.9MEDIUM

Key Information:

Vendor

Pandora Fms

Status
Pandora Fms
Vendor
CVE Published:
29 December 2023

What is CVE-2023-44088?

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.

Affected Version(s)

Pandora FMS all 700 <= 774

References

https://pandorafms.com/en/security/common-vulnerabilities...
vendor-advisory

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Osama Yousef <[email protected]>
.