Vulnerability Details CVE-2021-27513
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.45
EPSS Ranking 97.4%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
- https://github.com/ArianeBlow/exploit-eyesofnetwork5.3.10/blob/main/PoC-BruteForceID-arbitraty-file-upload-RCE-PrivEsc.py
- https://github.com/EyesOfNetworkCommunity/eonweb/issues/87
- https://github.com/ArianeBlow/exploit-eyesofnetwork5.3.10/blob/main/PoC-BruteForceID-arbitraty-file-upload-RCE-PrivEsc.py
- https://github.com/EyesOfNetworkCommunity/eonweb/issues/87
Products affected by CVE-2021-27513
-
cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-10