Pandora FMS EUVD-2026-90600

Requires a valid authenticated Pandora FMS session (PR:L) with access to the Grafana datasource endpoint, which is the integration exposing Pandora FMS monitoring data to Grafana. The attacker injects SQL through the 'module' request parameter; no user interaction is needed (UI:N). Exploitation is limited to Pandora FMS version 777 and later and is gated by holding valid console credentials, so unauthenticated internet attackers cannot exploit it directly against a default login-protected deployment.

The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) reflects a network-reachable, low-complexity, low-privilege blind SQL injection whose primary impact is high confidentiality (database read) with limited integrity and availability effects. The vendor-supplied vector's threat/supplemental metrics (AU:Y, R:U, V:C, RE:L, U:Red) indicate the attack requires some authenticated interaction and is recoverable, consistent with a serious but not catastrophic data-exposure flaw. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The chief limiting factor is authentication: PR:L means an attacker must already hold a valid Pandora FMS account, which downgrades this from a wormable mass-exploitation threat to a post-authentication data-theft risk - a genuine priority for internet-exposed or multi-tenant Pandora FMS consoles, but lower urgency where console access is tightly restricted. Only the vendor's own security page is cited; no independent (NVD/CISA) corroboration of affected versions or patch status is available.

An attacker with a low-privilege authenticated Pandora FMS account sends a crafted request to the Grafana datasource endpoint, placing SQL into the unsanitized 'module' parameter. Because the injection is blind, the attacker uses boolean/time-based inference to extract database contents (credentials, monitoring data, configuration) row by row. No proof-of-concept is publicly available, and the low attack complexity makes exploitation reliable once valid credentials are obtained.