Technical Details

Root Cause

The from parameter accepted by the /ewconsole/ewconsole.dll/editUserName endpoint is reflected directly into the HTML response body without any HTML encoding or output sanitization. This allows an attacker to break out of the HTML attribute context and inject a <script> tag or other event-handler payload that is executed immediately by the browser.

Affected Endpoint

Attack Vector

• Network — exploitable remotely via a crafted URL
• Authentication — victim must be authenticated as a console user; the attacker does not need credentials
• User Interaction — required (victim must click the malicious link)

Proof of Concept

Prerequisites

1. Access to a live or local installation of eScan Management Console 14.0.1400.2281.
2. A logged-in admin or regular user session in the target browser.

Steps to Reproduce

1. Log in to the eScan Management Console with valid credentials.

2. Navigate to the following baseline URL to confirm the from parameter is reflected:

   root@kitploit:~

   https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from=banner&P=
   

3. Replace the from value with the XSS payload below and open the crafted URL in the victim's authenticated browser:

   root@kitploit:~

   https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from="><script>alert(document.cookie)</script>banner&P=
   

4. The browser will execute the injected script and display an alert box containing the session cookie, confirming the vulnerability.

Screenshot

Impact

Remediation

Microworld Technologies should apply the following mitigations:

1. Output Encoding (primary defense) — HTML-encode all user-controlled values before inserting them into HTML responses. At minimum, encode <, >, ", ', and &. This alone prevents the injected markup from being interpreted by the browser.
2. Input Validation (defense-in-depth) — Use allowlists to restrict parameter values to their expected format (e.g., alphanumeric strings for the from parameter) rather than attempting to denylist specific characters, which is easily bypassed.
3. Content Security Policy (CSP) — Deploy a strict CSP header (e.g., Content-Security-Policy: default-src 'self') to limit the impact of any remaining XSS vectors.
4. HttpOnly Cookies — Mark session cookies with the HttpOnly flag to prevent JavaScript from accessing them even if an XSS payload is executed.

References

• CVE-2023-31703 — NVD
• Microworld Technologies eScan
• OWASP — Cross-Site Scripting (XSS)

Disclaimer

This information is provided for educational and responsible disclosure purposes only. The author is not responsible for any misuse of this information. Always obtain proper authorization before testing any system you do not own.