Vulnerability Title: Server side request forgery - Api checker Module
Vendor Homepage: https://pandorafms.com/en/
Version: <= v767
CVE: CVE-2023-24515
CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5 Medium)
Exploit Author: Damodar Naik
Date: 08/22/2023
- Login as evil admin user.
- Go to Admin tools -> Api checker.
- Enter file:///etc/passwd in the custom URL section & observe the response.
- To make it more interesting, use file:///var/www/html/pandora_console/pandoradb_data.sql as the url value & observe DB file content being loaded in the response.