CVE-2020-8656: EyesOfNetwork API SQL injection allows unauthenticated auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with CVSS 9.8, very high EPSS and public exploit references makes this an urgent patch target.

What it is

The EyesOfNetwork API 2.4.2 in EyesOfNetwork 5.3 is vulnerable to SQL injection in the username field passed to getApiKey in include/api_functions.php. Because the flaw is reachable without authentication, it exposes the monitoring platform's API to direct compromise.

Impact

An attacker can bypass authentication and obtain an API key, then perform actions available to the API, with the CVSS vector indicating high confidentiality, integrity and availability impact.

Attack surface

Reachable over the network through the EyesOfNetwork API endpoint handling getApiKey in include/api_functions.php; no authentication or user interaction is required per the CVSS vector and description.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.846, ~99.7th percentile) and public references are tagged Exploit, including a remote code execution write-up, so exploitation is feasible and likely.

What to do

• Apply the vendor fix or upgrade EyesOfNetwork/eonapi beyond the affected 5.3 / API 2.4.2 versions.
• Restrict network access to the EyesOfNetwork API to trusted management networks only.
• Use parameterized queries or strict input validation for the username field in getApiKey.
• Rotate API keys and credentials that may have been exposed through the API.
• Monitor and alert on anomalous API authentication attempts against getApiKey.

Detection

• Inspect web and API logs for requests to getApiKey with SQL metacharacters or boolean/UNION patterns in the username parameter.
• Alert on successful API key retrieval from unexpected source IPs or without prior legitimate authentication.
• Review EyesOfNetwork API and database logs for SQL error messages or unusual query behavior.
• Hunt for post-exploitation activity consistent with the published remote code execution chain on EyesOfNetwork hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.