# CVE-2018-11222: Pandora FMS - RCE

> Live exploitation tracking for CVE-2018-11222 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-11222

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Artica Pandora FMS
- **Weaknesses:** CWE-20 (Improper Input Validation)

## Description

Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.

## CrowdSec analysis

This vulnerability, tracked by EUVD under [CVE-2018-11222](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-11222), is a Local File Inclusion (LFI) flaw in Artica Pandora FMS up to version 7.23, allowing attackers to execute arbitrary PHP files via the /pandora_console/ajax.php endpoint. Exploiting this vulnerability could lead to remote code execution, enabling threat actors to compromise the affected system and potentially gain full control.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2018-11222 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit Pandora FMS by accessing `/pandora_console/ajax.php` with a crafted `page` parameter pointing to `/plugin/phpinfo`, which triggers execution of a maliciously uploaded PHP file and leads to remote code execution.

## Timeline

- 2018-06-15: CVE Published. CVE-2018-11222 is published to NVD.
- 2025-05-28: Rule Released. CrowdSec releases a rule to detect CVE-2018-11222 exploitation attempts against the CrowdSec Network.
- 2025-12-02: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2018-11222 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11222.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-11222) follows observed exploitation activity for CVE-2018-11222. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.