damodarnaik

CVE-2023-24515

Vulnerability Title: Server side request forgery - Api checker Module
Vendor Homepage: https://pandorafms.com/en/
Version: <= v767
CVE: CVE-2023-24515
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5 Medium)
Exploit Author: Damodar Naik
Date: 08/22/2023

Steps to reproduce:

1. Login as evil admin user.

damodarnaik

CVE-2022-45436

Vulnerability Title: Reflected Cross Site Scripting - Network maps editor module
Vendor Homepage: https://pandorafms.com/en/
Version: <= v765
CVE: CVE-2022-45436
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (4.8 Medium)
Exploit Author: Damodar Naik
Date: 02/14/2023

Steps to reproduce:

1. Navigate to Topology maps -> Network map as an attacker, and click on the help button.

damodarnaik

CVE-2022-45437

# Vulnerability Title: Stored Cross Site Scripting - Dashboard Module
# Vendor Homepage: https://pandorafms.com/en/
# Version: <= v765
# CVE: CVE-2022-45437
# CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (4.8 Medium)
# Exploit Author: Damodar Naik
# Date: 02/14/2023

Steps to reproduce:

damodarnaik

CVE-2022-47372

# Vulnerability Title: Stored Cross Site Scripting - Create Event Module
# Vendor Homepage: https://pandorafms.com/en/
# Version: <= v765
# CVE: CVE-2022-47372
# CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4 Medium)
# Exploit Author: Damodar Naik
# Date: 02/14/2023

Steps to reproduce: