CVE-2023-31702

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-05-17 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.

Affected products

Escanav Escan Management Console: 14.0.1400.2281

References

http://packetstormsecurity.com/files/172545/eScan-Management-Console-14.0.1400.2281-SQL-Injection.html
https://github.com/sahiloj/CVE-2023-31702/blob/main/README.md
http://packetstormsecurity.com/files/172545/eScan-Management-Console-14.0.1400.2281-SQL-Injection.html
https://github.com/sahiloj/CVE-2023-31702/blob/main/README.md

Get alerted when CVE-2023-31702 or the next vulnerability affects your stack