In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.
References
Link | Resource |
---|---|
http://kk.whitecell-club.org/index.php/archives/220/ | Exploit Third Party Advisory |
Configurations
Information
Published : 2017-09-03 13:29
Updated : 2021-02-23 07:06
NVD link : CVE-2017-14118
Mitre link : CVE-2017-14118
JSON object : View
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Products Affected
eyesofnetwork
- eyesofnetwork