CVE-2023-34836 PoC — MicroWorld Technologies eScan Management Console 跨站脚本漏洞

Source

Associated Vulnerability

Readme

## eScan Management Console 14.0.1400.2281 - Reflected Cross Site Scripting ###

**Description:**
Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via vulnerable parameters like Dtltyp and ListName.

**Vulnerable Product Version:**
14.0.1400.2281

**Date:**
23/06/2023

**CVE:** 
CVE-2023-34836

**CVE Author:**
Sahil Ojha

**Vendor Homepage:**
https://www.escanav.com

**Software Link:** 
https://cl.escanav.com/ewconsole.dll

**Tested on:** 
Windows

**Steps to reproduce:**
1. Login into the eScan Management Console with a valid user credential. Here, escan management console is on internal network.
2. Navigate to "User Activity >> File Activity Report" feature.
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-34836/blob/main/1.png)
   ---
3. Capture the GET request in burpsuite and inject the XSS paylaod into "Dtltyp" and "ListName" parameter as shown in fugure below.
   
   ![HTML Render](https://github.com/sahiloj/CVE-2023-34836/blob/main/3.png)
   ---
4. After forwarding the request, an XSS alert will pop up which could be modified to extract user session cookie as well.
 ![HTML Render](https://github.com/sahiloj/CVE-2023-34836/blob/main/4.png)

File Snapshot

 [4.0K]  /data/pocs/6ab5e17542d108cf7aa736e66f24fbee44f4b22b
├── [146K]  1.png
├── [168K]  2.png
├── [179K]  3.png
├── [158K]  4.png
└── [1.2K]  README.md

0 directories, 5 files

Remarks