CVE Feed

    Dashboard / CVE / CVE-2020-8654

    CVE-2020-8654

    An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.

    Published:Feb 6, 2020
    Last Modified:Nov 21, 2024
    EPS:Feb 6, 2020
    EPSS Score:0.91842
    CVSS Score:8.8

    Affected Products

    Vendor
    Eyesofnetwork
    Product
    Eyesofnetwork

    Exploits

    http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.htmlhttps://github.com/EyesOfNetworkCommunity/eonweb/issues/50http://packetstormsecurity.com/files/156266/EyesOfNetwork-5.3-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.htmlhttps://github.com/EyesOfNetworkCommunity/eonweb/issues/50https://www.exploit-db.com/exploits/48169https://www.exploit-db.com/exploits/48025

    Related CVEs

    CVE-2022-41572 (CVSS 9.8) — An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the…
    CVE-2022-41571 (CVSS 9.8) — An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.…
    CVE-2022-41570 (CVSS 9.8) — An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.…
    CVE-2021-40643 (CVSS 9.8) — EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration pa…
    CVE-2022-24612 (CVSS 5.4) — An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, re…
    CVE-2021-33525 (CVSS 8.8) — EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution (by authenticated users) via shell metacha…
    CVE-2021-27513 (CVSS 8.8) — The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php f…
    CVE-2021-27514 (CVSS 9.8) — EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged f…
    CVE-2020-27887 (CVSS 8.8) — An issue was discovered in EyesOfNetwork 5.3 through 5.3-8. An authenticated web user with sufficient privileg…
    CVE-2020-27886 (CVSS 9.8) — An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQ…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High