CVE-2017-15880

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.1-0

Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the group name parameter to the "module/admin group/add modify group.php" endpoint, specifically for insert group and update group actions.

Recommendations For version 5.1-0, consider restricting access to the module/admin group/add modify group.php endpoint to minimize the risk of exploitation, and avoid using the group name parameter until the issue is resolved.