{"vulnerability": "cve-2024-12971", "sightings": [{"uuid": "7b113253-f641-432a-a7ed-d73396d50320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3ll7fwfod622f", "content": "", "creation_timestamp": "2025-03-25T13:48:12.651412Z"}, {"uuid": "2d585df9-2475-4878-9011-94cc73f0d45e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lklcf3k33y2w", "content": "", "creation_timestamp": "2025-03-17T13:51:35.682834Z"}, {"uuid": "1db49d95-7525-4000-8fa1-6b76b6a61b01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lmdep7fpg42t", "content": "", "creation_timestamp": "2025-04-08T21:02:09.749731Z"}, {"uuid": "6f1a6885-8ad8-4b5b-a21a-e708e944d4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:02.000000Z"}, {"uuid": "1718f912-6066-4326-851c-68a8529ac948", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_12971.rb", "content": "", "creation_timestamp": "2025-04-08T05:57:06.000000Z"}, {"uuid": "71ae5b06-de42-4fe7-bf5f-61bf91f88444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/7749", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-12971\n\ud83d\udd25 CVSS Score: 8.6 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/S:N/AU:Y/R:U/V:C/RE:L/U:Green)\n\ud83d\udd39 Description: Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6\n\ud83d\udccf Published: 2025-03-17T09:19:31.761Z\n\ud83d\udccf Modified: 2025-03-17T09:19:31.761Z\n\ud83d\udd17 References:\n1. https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/", "creation_timestamp": "2025-03-17T09:46:57.000000Z"}, {"uuid": "373bdc3b-47b3-4e16-b694-13527c9b0e57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://t.me/cvedetector/20456", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-12971 - Pandora FMS OS Command Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-12971 \nPublished : March 17, 2025, 10:15 a.m. | 1\u00a0hour, 23\u00a0minutes ago \nDescription : Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"17 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-17T13:17:08.000000Z"}, {"uuid": "96fbb7ad-a085-4dde-94fb-f7be2f3d466a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-12971", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_12971.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd\", \"author\": [\"h00die-gr3y \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Pandora FMS is a monitoring solution that provides full observability for your organization's\\n          technology. This module exploits an command injection vulnerability in the `chromium-path` or\\n          `phantomjs-bin` directory setting at the application settings page of Pandora FMS.\\n          You need have admin access at the Pandora FMS Web application in order to execute this RCE.\\n          This access can be achieved by knowing the admin credentials to access the web application or\\n          leveraging a default password vulnerability in Pandora FMS that allows an attacker to access\\n          the Pandora FMS MySQL database, create a new admin user and gain administrative access to the\\n          Pandora FMS Web application. This attack can be remotely executed over the WAN as long as the\\n          MySQL services are exposed to the outside world.\\n          This issue affects Community, Free and Enterprise editions:\\n          - chromium-path: from v7.0NG.768 through <= v7.0NG.780\\n          - phantomjs-bin: from v7.0NG.724 through <= v7.0NG.767\\n\\n          Note: use target setting 2 \\\"Tiny Reverse Netcat Command\\\" for versions <= v7.0NG.738\", \"disclosure_date\": \"2025-03-17\", \"fullname\": \"exploit/linux/http/pandora_fms_auth_rce_cve_2024_12971\", \"is_install_path\": true, \"mod_time\": \"2026-07-25 19:22:12 +0000\", \"name\": \"Pandora FMS authenticated command injection leading to RCE via chromium_path or phantomjs_bin\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/pandora_fms_auth_rce_cve_2024_12971.rb\", \"platform\": \"Linux,PHP,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/pandora_fms_auth_rce_cve_2024_12971\", \"references\": [\"CVE-2024-12971\", \"URL-https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/\", \"URL-https://attackerkb.com/topics/BJe14wkMYS/cve-2024-12971\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"PHP Command\", \"Unix/Linux Command\", \"Tiny Reverse Netcat Command (use THIS for versions <= v738)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:50.457005Z"}]}