CVE-2020-27886: 
EyesOfNetwork vulnerability analysis and mitigation

An SQL injection vulnerability was discovered in EyesOfNetwork eonweb versions 5.3-7 through 5.3-8. The vulnerability exists in the username_available function of the includes/functions.php file (which is called by login.php), allowing an unauthenticated attacker to exploit the web interface (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'). The issue affects the authentication mechanism in the eonweb web interface, specifically in the username_available function (NVD).

The SQL injection vulnerability allows an unauthenticated attacker to potentially access, modify, or delete database contents. Due to the critical nature of the vulnerability and its location in the authentication mechanism, successful exploitation could lead to complete system compromise (NVD).

The vulnerability can be exploited remotely without requiring any authentication or user interaction. The attack complexity is considered low, making it relatively straightforward for attackers to exploit (NVD).

A patch has been released to address this vulnerability. Users should upgrade to a version newer than EyesOfNetwork 5.3-8 (EON Product).

The vulnerability was reported and tracked through the EyesOfNetwork Community GitHub repository, where it was classified as a critical security issue. The development team acknowledged the vulnerability and worked on providing a fix (GitHub Issue).