Description: Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format resulting in vertical as well as horizontal privilege escalation.
Vulnerable Product Version: 14.0.1400.2281
Date: 30/05/2023
CVE: CVE-2023-33730
CVE Author: Sahil Ojha
Vendor Homepage: https://www.escanav.com
Software Link: https://cl.escanav.com/ewconsole.dll
Tested on: Windows
Steps to reproduce:
-
Go to the eScan application with valid admin users credentials and create a new user with normal level access.
-
Login with the credentials of normal level user.
-
Capture the GET request of the normal user editing their information as shown in the screenshot below.
-
Send the GET request to the repeater in Burp suite and forward the GET the request. The response returns the password of the normal user in plaintext.
-
Changing the parameter ‘UsrId’ the response returns passwords of the administrator and all the other users in plaintext as shown in the screenshot below.
-
The password is then used to login to the administrator/other user's account gaining all administrator privileges.
