CVE-2019-20224

Description

netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip_src parameter in an index.php?operation/netflow/nf_live_view request. This issue has been fixed in Pandora FMS 7.0 NG 742.

Weakness classification

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Primary references

• cve@mitre.org — Exploit, Third Party Advisory, VDB Entry
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org
• cve@mitre.org — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory