EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to...
Vulnerability Description
EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-6087
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.openwall.com/lists/oss-security/2017/03/23/5
- https://github.com/EyesOfNetworkCommunity/eonweb/commit/196729cc045ef93ceeddd1de505a1de8f9cdf74d
- https://www.exploit-db.com/exploits/41746/
- https://sysdream.com/news/lab/2017-03-14-cve-2017-6087-eon-5-0-remote-code-execution/
- http://www.securityfocus.com/bid/97109
Affected Vendor
eonweb project
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.