The vulnerability is an SQL injection flaw in the graph container parameter. An attacker who can supply or influence this parameter could inject arbitrary SQL code. The primary consequence is the ability to read, modify, or delete data stored in the database, potentially leading to data leakage or tampering. The weakness is a classic input validation issue classified as CWE-89.

Pandora FMS versions 777 through 800 are affected. The fix is available in v802 and v800.2. These versions expose the graph container endpoint without proper sanitization. Users running any intermediary build between 777 and 800 remain vulnerable until updated.

The CVSS score of 7.6 indicates high impact and medium to high exploitation potential. The EPSS score is not provided, so the exact market exploitation probability is unknown but the bug is significant. It is not listed in the CISA KEV catalog, indicating no publicly known, widespread exploitation yet. The likely attack vector is through the web interface where the graph container parameter can be supplied by an authenticated or unauthenticated user, depending on the application’s access controls. If the application allows untrusted input, an attacker could leverage this injection to compromise the database.