title: SQL Injection in Visual Console
description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.
problem types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
defaultStatus: unaffected
platforms: all
product: Pandora FMS
vendor: Pandora FMS
versions:
lessThanOrEqual: 774, status: affected, version: 700, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Fixed in v775.