CVE-2020-9465

EPSS 82.2%

Vexday Risk Score

40Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 82.2%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

06 Feb 2020Metasploit module available

28 Feb 2020Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in EyesOfNetwork eonweb 5.1 through 5.3 before 5.3-3. The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the user_id field in a cookie.

Affected products

n/a · n/a

References

https://github.com/EyesOfNetworkCommunity/eonweb/issues/51 https://github.com/EyesOfNetworkCommunity/eonweb/releases/tag/5.3-3