← back
CVE-2010-4281

CVE-2010-4281

EPSS 9.6%
Incomplete blacklist vulnerability in the safe_url_extraclean function in ajax.php in Pandora FMS before 3.1.1 allows remote attackers to execute arbitrary PHP code by using a page parameter containing a UNC share pathname, which bypasses the check for the : (colon) character.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/15643unverifiedexploitdbwww.exploit-db.com/exploits/15643unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://osvdb.org/69546http://seclists.org/fulldisclosure/2010/Nov/326http://secunia.com/advisories/42347http://sourceforge.net/projects/pandora/files/Pandora%20FMS%203.1/Final%20version%20%28Stable%29/pandorafms_console-3.1_security_patch_13Oct2010.tar.gz/downloadhttp://www.exploit-db.com/exploits/15643http://www.securityfocus.com/archive/1/514939/100/0/threadedhttp://www.securityfocus.com/bid/45112