CVE-2017-15880
HighSummary
CVE-2017-15880 is an SQL injection vulnerability in the EyesOfNetwork web interface (eonweb) version 5.1-0 that allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php.
Risk Assessment
This vulnerability could lead to unauthorized access to the database and data manipulation, which may have serious implications for the organization's security.
Recommendation
It is recommended to upgrade to the latest version of EyesOfNetwork to eliminate this vulnerability and implement additional security measures such as input validation.
Other vulnerabilities in EyesOfNetwork web interface (eonweb) 5.1-0
See all- CVE-2017-16000High
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
- CVE-2017-15933High
CVE-2017-15933 is a SQL injection vulnerability in the EyesOfNetwork web interface (eonweb) version 5.1-0. It allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.
- CVE-2017-14405High
The EyesOfNetwork web interface version 5.1-0 allows remote command execution via shell metacharacters in the hosts_cacti array parameter to module/admin_device/index.php.
- CVE-2017-14404High
The EyesOfNetwork web interface version 5.1-0 allows local file inclusion via the tool_list parameter in select_tool.php.
- CVE-2017-14118High
The EyesOfNetwork web interface (eonweb) version 5.1-0 has a vulnerability that improperly restricts exec calls. This allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.
- CVE-2017-14252Critical
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
- CVE-2017-14247Critical
SQL Injection exists in the EyesOfNetwork web interface (eonweb) 5.1-0 via the user_id cookie to header.php.
Original NVD description (English source)
SQL injection vulnerability vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php (for insert_group and update_group).