Pandora FMS - RCE (CVE-2018-11222)

This vulnerability, tracked by EUVD under CVE-2018-11222, is a Local File Inclusion (LFI) flaw in Artica Pandora FMS up to version 7.23, allowing attackers to execute arbitrary PHP files via the /pandora_console/ajax.php endpoint. Exploiting this vulnerability could lead to remote code execution, enabling threat actors to compromise the affected system and potentially gain full control.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2018-11222 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. In addition, according to the CrowdSec network, attack volume against CVE-2018-11222 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit Pandora FMS by accessing /pandora_console/ajax.php with a crafted page parameter pointing to /plugin/phpinfo, which triggers execution of a maliciously uploaded PHP file and leads to remote code execution.