published February 6, 2020
NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.
🚨 This SQL injection in EyesOfNetwork 5.3 lets attackers waltz right in with no authentication! Think of it as a restaurant where anyone can stroll in and serve themselves from the buffet without a reservation or even a menu card — that’s how easy it is to bypass the security here! An attacker can exploit this flaw to bypass authentication through the username field, potentially gaining unauthorized access to sensitive API functions. With this level of access, they could perform harmful actions without anyone batting an eye!
Think of it as a restaurant where anyone can stroll in and serve themselves from the buffet without a reservation or even a menu card — that’s how easy it is to bypass the security here! The EyesOfNetwork API 2.4.2 is vulnerable to SQL injection, allowing unauthenticated users to manipulate the username field in requests to getApiKey within include/api_functions.php, leading to authentication bypass.
An attacker can exploit this flaw to bypass authentication through the username field, potentially gaining unauthorized access to sensitive API functions. With this level of access, they could perform harmful actions without anyone batting an eye! Update to the latest version of EyesOfNetwork to patch this vulnerability and ensure that input validation is properly implemented in your API endpoints. Additionally, review your API access controls to mitigate risks. You've got this! With these steps, you can fortify your defenses and keep your data safe! 🛡️