CVE-2017-14118 - In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php

Back Back to CVE browser

HIGH

In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php

Published Sep 3, 2017

8.8

HIGH

CVSS 3.0

EPSS 2.38%

Description

In the EyesOfNetwork web interface (aka eonweb) 5.1-0, module\tool_all\tools\interface.php does not properly restrict exec calls, which allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

http://kk.whitecell-club.org/index.php/archives/220/
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5630
Advisory

Link	Providers	Tags
http://kk.whitecell-club.org/index.php/archives/220/		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-5630		Advisory