CVE-2017-13780
HighSummary
The EyesOfNetwork web interface version 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
Risk Assessment
An attacker could gain access to sensitive files on the server, potentially leading to data exposure or system compromise.
Recommendation
It is recommended to update to the latest version of the software and implement appropriate security measures to block directory traversal attacks.
Other vulnerabilities in EyesOfNetwork web interface 5.1-0
See all- CVE-2017-14403Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the term parameter in module/admin_group/search.php.
- CVE-2017-14402Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT CREATION' section, related to lack of input validation in include/function.php.
- CVE-2017-14401Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT UPDATE' section.
Original NVD description (English source)
The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.