EyesOfNetwork web interface (eonweb) 5.1-0 vulnerabilities

8 known CVE vulnerabilities in EyesOfNetwork web interface (eonweb) 5.1-0, translated and rated.

CVE-2017-16000High
SQL injection vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the graph parameter to module/capacity_per_label/index.php.
CVE-2017-15933High
CVE-2017-15933 is a SQL injection vulnerability in the EyesOfNetwork web interface (eonweb) version 5.1-0. It allows remote authenticated administrators to execute arbitrary SQL commands via the host parameter to module/capacity_per_device/index.php.
CVE-2017-15880High
CVE-2017-15880 is an SQL injection vulnerability in the EyesOfNetwork web interface (eonweb) version 5.1-0 that allows remote authenticated administrators to execute arbitrary SQL commands via the group_name parameter to module/admin_group/add_modify_group.php.
CVE-2017-14405High
The EyesOfNetwork web interface version 5.1-0 allows remote command execution via shell metacharacters in the hosts_cacti array parameter to module/admin_device/index.php.
CVE-2017-14404High
The EyesOfNetwork web interface version 5.1-0 allows local file inclusion via the tool_list parameter in select_tool.php.
CVE-2017-14118High
The EyesOfNetwork web interface (eonweb) version 5.1-0 has a vulnerability that improperly restricts exec calls. This allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.
CVE-2017-14252Critical
SQL Injection exists in the EyesOfNetwork web interface (aka eonweb) 5.1-0 via the group_id cookie to side.php.
CVE-2017-14247Critical
SQL Injection exists in the EyesOfNetwork web interface (eonweb) 5.1-0 via the user_id cookie to header.php.