CVE-2017-6088 : Security Advisory and Response

EyesOfNetwork (EON) versions 5.0 and earlier contain multiple SQL injection vulnerabilities that could be exploited by remote authenticated users to execute unauthorized SQL commands.

Understanding CVE-2017-6088

EyesOfNetwork (EON) versions 5.0 and earlier are affected by SQL injection vulnerabilities that can be triggered by providing malicious input through specific parameters.

What is CVE-2017-6088?

EyesOfNetwork (EON) versions 5.0 and earlier are susceptible to SQL injection attacks, allowing remote authenticated users to execute arbitrary SQL commands through certain parameters in specific files.

The Impact of CVE-2017-6088

These vulnerabilities could enable attackers to execute unauthorized SQL commands, potentially leading to data theft, manipulation, or unauthorized access within the affected systems.

Technical Details of CVE-2017-6088

EyesOfNetwork (EON) versions 5.0 and earlier are vulnerable to SQL injection attacks, posing a security risk to the systems running these versions.

Vulnerability Description

The vulnerabilities in EyesOfNetwork (EON) versions 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands by manipulating specific parameters in certain files.

Affected Systems and Versions

Product: EyesOfNetwork (EON)
Vendor: N/A
Versions affected: 5.0 and earlier

Exploitation Mechanism

The vulnerabilities can be exploited by providing malicious input through the following parameters:

bp_name
display
search
equipment in the module/monitoring_ged/ged_functions.php file
type parameter in monitoring_ged/ajax.php

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2017-6088 and implement long-term security practices to prevent similar vulnerabilities in the future.

Immediate Steps to Take

Update EyesOfNetwork (EON) to a patched version that addresses the SQL injection vulnerabilities.
Monitor and restrict access to the vulnerable parameters to prevent unauthorized exploitation.

Long-Term Security Practices

Regularly audit and review the codebase for potential security flaws.
Educate users on secure coding practices and the importance of input validation to prevent SQL injection attacks.

Patching and Updates

Apply security patches provided by the vendor promptly to address the SQL injection vulnerabilities in EyesOfNetwork (EON) versions 5.0 and earlier.