PT-2020-16825 · Eyesofnetwork · Eyesofnetwork Eonweb

H4Knet · Published 2020-10-29 · Updated 2021-02-23 · CVE-2020-27886

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.3-7 through 5.3-8

Description The issue is related to a SQL injection in the eonweb web interface, allowing an unauthenticated attacker to exploit the username available function of the includes/functions.php file, which is called by login.php.

Recommendations For EyesOfNetwork eonweb versions 5.3-7 through 5.3-8, consider disabling the username available function in the includes/functions.php file as a temporary workaround until a patch is available. Restrict access to the login.php file to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-27886

Affected Products

Eyesofnetwork Eonweb

References · 6

• http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x86_64-bin.iso · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27886 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27886 · Vendor Advisory
• https://github.com/EyesOfNetworkCommunity/eonweb/issues/76 · Note
• https://t.me/cibsecurity/15755 · Telegram Post
• https://eyesofnetwork.com/en · Note