CVE-2024-9987: Pandora FMS SQL Injection Vulnerability

CVE-2024-9987 Overview

CVE-2024-9987 is a post-authentication SQL Injection vulnerability in Pandora FMS, an enterprise IT infrastructure monitoring platform. The flaw resides in the filters parameter of the extensions/agents_modules_csv functionality. Authenticated attackers can inject arbitrary SQL statements to read, modify, or exfiltrate data from the backend database. The vulnerability affects Pandora FMS versions 700 through versions earlier than 777.3 and is classified under CWE-89.

Critical Impact
Authenticated attackers can execute arbitrary SQL queries against the Pandora FMS database, leading to disclosure or manipulation of monitoring data, credentials, and configuration.

Affected Products

Pandora FMS versions 700 through versions prior to 777.3
Pandorafms pandora_fms package (CPE: cpe:2.3:a:pandorafms:pandora_fms:*:*:*:*:*:*:*:*)
Deployments exposing the extensions/agents_modules_csv endpoint to authenticated users

Discovery Timeline

2024-10-22 - CVE-2024-9987 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9987

Vulnerability Analysis

The vulnerability is a SQL Injection flaw in the CSV export extension used to generate agent module reports. The filters parameter passed to extensions/agents_modules_csv is concatenated into a SQL query without proper sanitization or parameterization. Any authenticated user with access to the extension can supply crafted SQL fragments through this parameter.

Exploitation requires valid Pandora FMS credentials, which raises the required privilege bar. However, the attack is network-reachable and requires no user interaction. Successful exploitation gives an attacker the ability to read arbitrary tables, extract stored credentials and API tokens, and modify monitoring data used for operational decisions.

Because Pandora FMS is typically deployed as a centralized monitoring server with broad visibility into infrastructure, database compromise can expose secrets that pivot into wider network access.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The filters parameter accepts user-controlled input that is embedded directly into a dynamically constructed SQL statement in the CSV export handler. The code path does not use prepared statements or a strict allow-list validator for filter values.

Attack Vector

An authenticated attacker sends an HTTP request to the extensions/agents_modules_csv endpoint with a malicious payload injected into the filters parameter. The backend concatenates the payload into a SQL query executed against the Pandora FMS database. Payloads can include UNION-based extraction, boolean-based blind exfiltration, or time-based blind techniques depending on query context.

No verified public proof-of-concept has been published. Refer to the Pandora FMS Vulnerabilities Guide for vendor technical detail.

Detection Methods for CVE-2024-9987

Indicators of Compromise

HTTP requests to /extensions/agents_modules_csv containing SQL metacharacters or keywords such as UNION, SELECT, SLEEP(, --, or encoded variants within the filters parameter.
Anomalous CSV export activity from user accounts that do not normally generate reports.
Database error messages or unusually long query execution times originating from the CSV export handler.
Unexpected reads against sensitive tables such as tusuario or tsesion in the Pandora FMS database.

Detection Strategies

Deploy web application firewall rules that inspect the filters query parameter for SQL Injection signatures on requests to agents_modules_csv.
Enable database query auditing to log statements originating from the Pandora FMS application user and alert on UNION SELECT or information_schema access.
Correlate authenticated Pandora FMS session activity with outbound data transfer volume to identify exfiltration.

Monitoring Recommendations

Alert on repeated 500-series HTTP responses from the CSV export endpoint, which often indicate injection probing.
Track authentication events for Pandora FMS accounts and flag logins from unusual source addresses that immediately access extensions/agents_modules_csv.
Baseline normal filters parameter values and flag requests whose length or character set deviates significantly.

How to Mitigate CVE-2024-9987

Immediate Actions Required

Upgrade Pandora FMS to version 777.3 or later, which contains the vendor fix.
Restrict access to the Pandora FMS console to trusted network segments using firewall or VPN controls.
Rotate credentials, API tokens, and secrets stored in the Pandora FMS database if exploitation is suspected.
Review Pandora FMS user accounts and revoke access for stale or excessively privileged users.

Patch Information

Pandora FMS resolved the issue in version 777.3. Consult the Pandora FMS Vulnerabilities Guide for the official advisory and upgrade instructions. Apply the upgrade in a maintenance window and validate the CSV export functionality after patching.

Workarounds

Where immediate patching is not possible, block or restrict access to /extensions/agents_modules_csv at the reverse proxy or WAF layer.
Enforce least-privilege on the database account used by Pandora FMS so it cannot read tables outside its operational scope.
Require multi-factor authentication for all Pandora FMS console accounts to raise the cost of credentialed access.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns in the filters parameter
SecRule ARGS:filters "@rx (?i)(union(\s|\+)+select|sleep\s*\(|information_schema|--|/\*)" \
    "id:1009987,phase:2,deny,status:403,msg:'Potential CVE-2024-9987 SQLi against Pandora FMS agents_modules_csv'"