CVE-2025-34088

Description

An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated users to execute arbitrary OS commands via the select_ips parameter when performing network tools operations, such as pinging. This occurs because user input is not properly sanitized before being passed to system commands, enabling command injection.

Reserved 2025-04-15 | Published 2025-07-03 | Updated 2025-07-03 | Assigner VulnCheck

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

*
affected

Credits

Onur ER finder

References

raw.githubusercontent.com/...x/http/pandora_ping_cmd_exec.rb exploit

www.exploit-db.com/exploits/48334 exploit

www.rapid7.com/.../exploit/linux/http/pandora_ping_cmd_exec/ third-party-advisory

github.com/pandorafms/pandorafms product

vulncheck.com/advisories/pandora-fms-rce-via-ping third-party-advisory

cve.org (CVE-2025-34088)

nvd.nist.gov (CVE-2025-34088)

Download JSON