CVE-2023-31702
📋 TL;DR
This SQL injection vulnerability in MicroWorld eScan Management Console allows remote attackers to execute arbitrary SQL commands via the GetUserCurrentPwd parameter. Successful exploitation can lead to complete database compromise and potentially remote code execution on the database server. Organizations running the affected eScan Management Console version are at risk.
💻 Affected Systems
- MicroWorld eScan Management Console
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise with sensitive data exfiltration, followed by remote code execution on the database server leading to full system takeover and lateral movement within the network.
Likely Case
Database information disclosure including user credentials, configuration data, and potentially sensitive organizational information stored in the eScan database.
If Mitigated
Limited impact with proper input validation and database permissions preventing command execution, though SQL injection may still reveal some database information.
🎯 Exploit Status
Public exploit code and detailed analysis available. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact MicroWorld support for updated version information and security patches.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the GetUserCurrentPwd parameter
Input Validation Filter
windowsAdd input validation to sanitize UsrId parameter before processing
🧯 If You Can't Patch
- Isolate the eScan Management Console from internet access and restrict network access to authorized IPs only
- Implement database-level controls: use least privilege accounts, disable xp_cmdshell, and enable SQL Server auditing
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads: /GetUserCurrentPwd?UsrId=1' OR '1'='1Check Version:
Check eScan Management Console version in application interface or installation directoryVerify Fix Applied:
Test with same payloads after remediation; successful fix should return error or no data instead of executing SQL📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in web logs
- Unexpected command execution events on database server
Network Indicators:
- HTTP requests to GetUserCurrentPwd with SQL injection patterns
- Unusual outbound database connections or data exfiltration
SIEM Query:
source="web_logs" AND uri="/GetUserCurrentPwd" AND (param="UsrId" AND value MATCH "[';]|OR|UNION|SELECT")🔗 References
- http://packetstormsecurity.com/files/172545/eScan-Management-Console-14.0.1400.2281-SQL-Injection.html
- https://github.com/sahiloj/CVE-2023-31702/blob/main/README.md
- http://packetstormsecurity.com/files/172545/eScan-Management-Console-14.0.1400.2281-SQL-Injection.html
- https://github.com/sahiloj/CVE-2023-31702/blob/main/README.md
