Published: 07/02/2020 Updated: 03/03/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An issue exists in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated malicious user to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
eyesofnetwork eonweb 5.3

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'EyesO ...

EyesOfNetwork version 53 suffers from code execution and remote SQL injection vulnerabilities ...

EyesOfNetwork 5.1 to 5.3 exploits

eonrce EyesOfNetwork 51 to 53 exploits Theses two exploit files uses the following CVE's: CVE_number__ Description CVE-2020-8654 Discovery module to allows to run arbitrary OS commandsWe were able to run the id command with the following payload in the target field : ;id # CVE-2020-8655 LPE via nmap NSE scriptAs the apache user is allowed to run nmap as root, w

CWE-89 http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.html http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html https://github.com/EyesOfNetworkCommunity/eonapi/issues/16 https://nvd.nist.gov https://exchange.xforce.ibmcloud.com/vulnerabilities/175978 https://github.com/h4knet/eonrce https://www.exploit-db.com/exploits/48169

CVE-2020-8656

Vulnerability Summary

Vulnerability Trend

Exploits

Mailing Lists

Github Repositories

References