CVE-2023-33730 PoC — Microworld Technologies eScan Management Console 安全漏洞

Source

Associated Vulnerability

Readme

## eScan Management Console 14.0.1400.2281 - Privilege Escalation ###

**Description:**
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format resulting in vertical as well as horizontal privilege escalation.

**Vulnerable Product Version:**
14.0.1400.2281

**Date:**
30/05/2023

**CVE:** 
CVE-2023-33730

**CVE Author:**
Sahil Ojha

**Vendor Homepage:**
https://www.escanav.com

**Software Link:** 
https://cl.escanav.com/ewconsole.dll

**Tested on:** 
Windows

**Steps to reproduce:**
1.	Go to the eScan application with valid admin users credentials and create a new user with normal level access.
 ![HTML Render](https://github.com/sahiloj/CVE-2023-33730/blob/main/1.png)
2.	Login with the credentials of normal level user.
 ![HTML Render](https://github.com/sahiloj/CVE-2023-33730/blob/main/2.png)
3.	Capture the GET request of the normal user editing their information as shown in the screenshot below.
![HTML Render](https://github.com/sahiloj/CVE-2023-33730/blob/main/3.png)
4.	Send the GET request to the repeater in Burp suite and forward the GET the request. The response returns the password of the normal user in plaintext.
 ![HTML Render](https://github.com/sahiloj/CVE-2023-33730/blob/main/4.png)
5.	Changing the parameter ‘UsrId’ the response returns passwords of the administrator and all the other users in plaintext as shown in the screenshot below.
![HTML Render](https://github.com/sahiloj/CVE-2023-33730/blob/main/5.png)

6.	The password is then used to login to the administrator/other user's account gaining all administrator privileges.

File Snapshot

 [4.0K]  /data/pocs/3af62c2fac5a8a564e2de00b9b775207559d3e77
├── [210K]  1.png
├── [160K]  2.png
├── [225K]  3.png
├── [330K]  4.png
├── [328K]  5.png
├── [1.7K]  CVE-2023-33730.md
└── [1.7K]  README.md

0 directories, 7 files

Remarks