CVE-2017-14401

The EyesOfNetwork web interface (eonweb) 5.1-0 contains a SQL injection vulnerability in the USERNAME column, exploitable via the user_name parameter to module/admin_user/add_modify_user.php within the ACCOUNT UPDATE section. This allows an attacker to construct arbitrary SQL commands, enabling d...

CVE-2017-14247

The CVE-2017-14247 issue affects EyesOfNetwork (EON) web interface, eonweb, version 5.1-0, via an SQL injection in header.php triggered by the user_id cookie. Connected sources corroborate a SQL injection path in eonweb that can be exploited remotely, with descriptions indicating unauthenticated ...

CVE-2017-14118

In the EyesOfNetwork web interface aka eonweb 5.1-0, module\toolall\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the hostlist parameter to module/toolall/selecttool.php...

Code injection

In the EyesOfNetwork web interface aka eonweb 5.1-0, module\toolall\tools\snmpwalk.php does not properly restrict popen calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in a parameter...

CVE-2017-14118

CVE-2017-14118 affects EyesOfNetwork (eonweb) 5.1-0. The vulnerability arises in module/tool_all/tools/interface.php, which fails to properly restrict exec calls. An attacker can supply shell metacharacters in the host_list parameter to module/tool_all/select_tool.php to execute arbitrary command...

CVE-2017-14119

The CVE-2017-14119 vulnerability affects EyesOfNetwork (eonweb) 5.1-0, specifically in module/tool_all/tools/snmpwalk.php, where popen calls are not properly restricted. This allows remote attackers to execute arbitrary commands by injecting shell metacharacters into a parameter. The issue is des...

CVE-2017-13780

The CVE-2017-13780 entry concerns EyesOfNetwork web interface (eonweb) 5.1-0. Affected component: module/admin_conf/download.php parameter. Root cause: directory traversal allows reading arbitrary files. Impact is read access to files outside intended scope. Public references across NVD/CNVD/OSV ...

EyesOfNetwork SQL Injection Vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. An SQL injection vulnerability exists in eonweb in EON version 5.1. A remote...

CVE-2017-1000060

EyesOfNetwork (EON) 5.1 has an unauthenticated SQL Injection in the web interface (eonweb) that leads to remote root. The vulnerability is described across multiple connected records as existing in EyesOfNetwork 5.1-0 and is related to CVE-2017-1000060. The root cause is an SQL injection vulnerab...

EyesOfNetwork (EON) 5.1 SQL Injection

Exploit Title: EyesOfNetwork EON 5.1 Unauthenticated SQL Injection in eonweb leading to remote root Google Dork: intitle:EyesOfNetwork intext:"sponsored by AXIANS" Date: 29/03/2017 Exploit Author: Dany Bach Vendor Homepage: https://www.eyesofnetwork.com/ Software Link:...

EyesOfNetwork (EON) 5.0 - Remote Code Execution

CVE-2017-6087 EON 5.0 Remote Code Execution Description EyesOfNetwork "EON" is an OpenSource network monitoring solution. Remote Code Execution authenticated The Eonweb code does not correctly filter arguments, allowing authenticated users to execute arbitrary code. CVE ID: CVE-2017-6087 Access...