CVE-2017-14404 Path traversal in n/a

What is CVE-2017-14404?

CVE-2017-14404 is a high-severity path traversal vulnerability in n/a, published on 13 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows local file inclusion via the tool_list parameter (aka the url_tool variable) to module/tool_all/select_tool.php, as demonstrated by a tool_list=php://filter/ substring.

Weakness: CWE-200

Which versions are affected by CVE-2017-14404?

It affects 1 product.

Products include Eyesofnetwork Eyesofnetwork.

How do I fix CVE-2017-14404?

No fix has been published for CVE-2017-14404 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2017-14404 being exploited?

There is no known exploitation of CVE-2017-14404 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-8657 EyesOfNetwork Use of Hard-Coded Credentials Exploited Critical 9.8
• CVE-2020-8655 EyesOfNetwork Improper Privilege Management Exploited High 7.8
• CVE-2022-41572 Privilege escalation in n/a Critical 9.8
• CVE-2022-41570 SQL injection in n/a Critical 9.8
• CVE-2022-41571 Path traversal in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3rq8-qw39-492w.