{"vulnerability": "cve-2024-11320", "sightings": [{"uuid": "c0d65a8d-a799-454e-8912-1aecaa050224", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2024-11320", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/113585196036174989", "content": "", "creation_timestamp": "2024-12-02T20:49:07.400150Z"}, {"uuid": "d07bfc87-e7be-4ac9-986e-863f406ce211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113520403781165691", "content": "", "creation_timestamp": "2024-11-21T10:11:36.093958Z"}, {"uuid": "b15576f5-9413-49e6-860d-6cc2d3486bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:46.000000Z"}, {"uuid": "2d6317b6-2a83-4f04-a5b7-b338bbe8dfc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:59.000000Z"}, {"uuid": "8519f9ef-d514-498a-8427-d149af957a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lpujowxvpo2s", "content": "", "creation_timestamp": "2025-05-23T21:02:25.080328Z"}, {"uuid": "0cf5f9e1-09f6-4e35-b6e5-f8c03107147d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:02.000000Z"}, {"uuid": "89e50736-b625-4a29-aa15-404223da5819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb", "content": "", "creation_timestamp": "2025-01-09T16:23:41.000000Z"}, {"uuid": "17f54f8d-4b28-4d43-a2f3-d1999b738d31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/9279", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aExploit for Pandora FMS Remote Code Execution CVE-2024-11320\nURL\uff1ahttps://github.com/mhaskar/CVE-2024-11320\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-12-01T12:59:15.000000Z"}, {"uuid": "c6e3cf47-bc38-4033-84bf-07f06d51e639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/TheDarkWebInformer/8332", "content": "\ud83d\udea8Exploit for Pandora FMS Remote Code Execution CVE-2024-11320\n\nhttps://darkwebinformer.com/exploit-for-pandora-fms-remote-code-execution-cve-2024-11320/", "creation_timestamp": "2024-12-02T22:46:08.000000Z"}, {"uuid": "a4fbe07d-3e9d-49d8-bd00-868cb33890c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/haj3imad/20902", "content": "https://github.com/mhaskar/CVE-2024-11320\n\nExploit for Pandora FMS Remote Code Execution CVE-2024-11320\n#github #exploit", "creation_timestamp": "2024-12-02T17:57:34.000000Z"}, {"uuid": "e5d937fa-b4ac-4555-b9fa-280bc32fa90b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2399", "content": "CVE-2024-11320 Pandora FMS\n*\nRCE exploit", "creation_timestamp": "2024-12-02T03:04:28.000000Z"}, {"uuid": "3d9007aa-7eaf-490d-9d04-eda2906bf4df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/crackvaultde/1170", "content": "\ud83d\udce2 CVE-2024-11320: Remote Code Execution in Pandora FMS\n https://crack-vault.de/d/546", "creation_timestamp": "2026-07-20T21:00:05.555149Z"}, {"uuid": "77adb346-f728-4332-a010-5c7c5e8c1c16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "published-proof-of-concept", "source": "https://t.me/crackvaultde/1170", "content": "\ud83d\udce2 CVE-2024-11320: Remote Code Execution in Pandora FMS\n https://crack-vault.de/d/546", "creation_timestamp": "2026-07-21T00:00:10.999261Z"}, {"uuid": "0419b72a-b269-47dd-a476-ad45f2b17195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-11320", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"h00die-gr3y \", \"Askar mhaskar\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Pandora FMS is a monitoring solution that provides full observability for your organization's\\n          technology. This module exploits an command injection vulnerability in the LDAP authentication\\n          mechanism of Pandora FMS.\\n          You need have admin access at the Pandora FMS Web application in order to execute this RCE.\\n          This access can be achieved leveraging a default password vulnerability in Pandora FMS that\\n          allows an attacker to access the Pandora FMS MySQL database, create a new admin user and gain\\n          administrative access to the Pandora FMS Web application. This attack can be remotely executed\\n          over the WAN as long as the MySQL services are exposed to the outside world.\\n          This issue affects Community, Free and Enterprise editions: from v7.0NG.718 through <= v7.0NG.777.4\", \"disclosure_date\": \"2024-11-21\", \"fullname\": \"exploit/linux/http/pandora_fms_auth_rce_cve_2024_11320\", \"is_install_path\": true, \"mod_time\": \"2026-07-25 19:22:12 +0000\", \"name\": \"Pandora FMS authenticated command injection leading to RCE via LDAP using default DB password\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_11320.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/pandora_fms_auth_rce_cve_2024_11320\", \"references\": [\"CVE-2024-11320\", \"URL-https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\", \"URL-https://attackerkb.com/topics/CsDUaLijbT/cve-2024-11320\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"PHP Command\", \"Unix/Linux Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:50.365811Z"}]}