The mother was able to rescue her son, but then the dog went for her.
"His jaws locked onto [the mother's] leg," the neighbour said.
"She was trying to fend the dog off and so she couldn't get back over the fence as well as fend the dog off.
"It was actually just really, really horrible.
"I don't actually like to see dogs fighting, let alone a dog trying to eat people. I had no idea how horrific it was."
The dog overpowered the mother and was attacking her on the ground, the neighbour said.
It seriously injured both women, who were hospitalised. The boy was also taken to hospital and was discharged this morning.
The neighbour said the dog's owners were "pretty gutted" over the whole thing.
A police spokeswoman said the incident was still being investigated.
Rotorua District Council animal control supervisor Kevin Coutts said the dog had been impounded, where it would stay until after investigations into the incident had been completed.
There were two dogs at the property, but one was tied up while the other, which attacked, was not, he said.
Both dogs on the property were unregistered but they were micro-chipped and de-sexed, as required for all dogs classified as a "menacing breed".
Other than a report of barking, there had been no previous reported incidents involving the two dogs, Mr Coutts said.
Both dogs were seized after the attack but the one not involved in the attack could be retrieved by the owner, provided registration and fees incurred following the seizure were paid, he said.
If police did not prosecute, the case would be handed back to the council, which could prosecute the owner for an attack on a person, which carries a maximum penalty of a fine of up to $3000.