PT-2020-20678 · Eyesofnetwork · Eyesofnetwork Eonweb

H4Kneto · Published 2020-02-28 · Updated 2021-02-23 · CVE-2020-9465

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3

Description An issue was discovered in the eonweb web interface, which is prone to a SQL injection. This allows an unauthenticated attacker to perform various tasks, such as authentication bypass via the user id field in a cookie.

Recommendations For EyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3, update to version 5.3-3 or later to resolve the issue. As a temporary workaround, consider restricting access to the eonweb web interface to minimize the risk of exploitation. Avoid using the user id field in cookies until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-9465

Affected Products

Eyesofnetwork Eonweb

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb · Exploit
• 🔥 https://github.com/EyesOfNetworkCommunity/eonweb/issues/51 · Exploit
• https://osv.dev/vulnerability/CVE-2020-9465 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9465 · Security Note
• https://github.com/EyesOfNetworkCommunity/eonweb/releases/tag/5.3-3 · Note