CVE-2017-14401
CriticalSummary
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT UPDATE' section.
Risk Assessment
Exploitation of this vulnerability may lead to unauthorized access to the database, threatening the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to upgrade to the latest version of EyesOfNetwork and to validate and sanitize input data in the application.
Other vulnerabilities in EyesOfNetwork web interface 5.1-0
See all- CVE-2017-13780High
The EyesOfNetwork web interface version 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
- CVE-2017-14403Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the term parameter in module/admin_group/search.php.
- CVE-2017-14402Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT CREATION' section, related to lack of input validation in include/function.php.
Original NVD description (English source)
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT UPDATE" section.