An issue exists in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated malicious user to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
|Vulnerable Product||Search on Vulmon||Subscribe to Product|
eyesofnetwork eonweb 5.3
EyesOfNetwork 5.1 to 5.3 exploits
eonrce EyesOfNetwork 51 to 53 exploits Theses two exploit files uses the following CVE's: CVE_number__ Description CVE-2020-8654 Discovery module to allows to run arbitrary OS commandsWe were able to run the id command with the following payload in the target field : ;id # CVE-2020-8655 LPE via nmap NSE scriptAs the apache user is allowed to run nmap as root, w