Clément Billac

10 exploits Active since Feb 2020
CVE-2020-8656 VULNCHECK_XDB CRITICAL WORKING POC
EyesOfNetwork 5.3 - Unauthenticated SQL Injection via Username Field in getApiKey
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
CVSS 9.8
CVE-2020-8655 VULNCHECK_XDB HIGH WORKING POC
EyesOfNetwork <5.3 - Privilege Escalation
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
CVSS 7.8
CVE-2020-8654 EXPLOITDB HIGH WORKING POC
EyesOfNetwork <5.3 - Command Injection
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
CVSS 8.8
CVE-2020-8655 EXPLOITDB HIGH WORKING POC
EyesOfNetwork <5.3 - Privilege Escalation
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
CVSS 7.8
CVE-2020-8654 EXPLOITDB HIGH ruby WORKING POC
EyesOfNetwork <5.3 - Command Injection
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
CVSS 8.8
CVE-2020-8655 EXPLOITDB HIGH ruby WORKING POC
EyesOfNetwork <5.3 - Privilege Escalation
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
CVSS 7.8
CVE-2020-8656 EXPLOITDB CRITICAL ruby WORKING POC
EyesOfNetwork 5.3 - Unauthenticated SQL Injection via Username Field in getApiKey
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
CVSS 9.8
CVE-2020-8654 METASPLOIT HIGH ruby WORKING POC
EyesOfNetwork <5.3 - Command Injection
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
CVSS 8.8
CVE-2020-8656 EXPLOITDB CRITICAL text WORKING POC
EyesOfNetwork 5.3 - Unauthenticated SQL Injection via Username Field in getApiKey
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
CVSS 9.8
CVE-2020-8657 EXPLOITDB CRITICAL ruby WORKING POC
EyesOfNetwork 5.1-5.3 AutoDiscovery Target Command Execution
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
CVSS 9.8