CVE-2017-14402
CriticalSummary
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT CREATION' section, related to lack of input validation in include/function.php.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized access to the database, jeopardizing the integrity and confidentiality of the organization's data.
Recommendation
It is recommended to implement proper input validation and update to the latest version of the software to mitigate the risks associated with this vulnerability.
Other vulnerabilities in EyesOfNetwork web interface 5.1-0
See all- CVE-2017-13780High
The EyesOfNetwork web interface version 5.1-0 allows directory traversal attacks for reading arbitrary files via the module/admin_conf/download.php file parameter.
- CVE-2017-14403Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the term parameter in module/admin_group/search.php.
- CVE-2017-14401Critical
The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT UPDATE' section.
Original NVD description (English source)
The EyesOfNetwork web interface (aka eonweb) 5.1-0 has SQL injection via the user_name parameter to module/admin_user/add_modify_user.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php.