CVE-2023-40924 PoC — Contec SolarView Compact 路径遍历漏洞

Source

https://github.com/Yobing1/CVE-2023-40924

Associated Vulnerability

Title:Contec SolarView Compact 路径遍历漏洞 (CVE-2023-40924)
Description:Contec SolarView Compact是日本Contec公司的一个应用系统。提供光伏发电测量系统。 SolarView Compact 6.00之前版本存在安全漏洞，该漏洞源于存在目录遍历漏洞。

Description

SolarView vuln

Readme

BUG_Author:
       YE 
Affected version:
      Contec SolarView Compact <6.00
Vendor:
      https://www.contecinc.com/

Vulnerability File:
      downloader.php
      Description:
Attacker exploit the vulnerability through downloader.php? The file parameter reads sensitive files through the directory pass.
![图片](https://github.com/Yobing1/SolarView-vuln-/assets/135513064/d1758aef-dc42-4d37-9f17-f4eb8324d90b)
downloader.php?file Existential directory traversal
It can read the sensitive file /etc/password 
![图片](https://github.com/Yobing1/SolarView-vuln-/assets/135513064/1d625d56-611e-4854-a3b1-4be2c106631c)
The password hash of the root administrator can be used to crack it
![图片](https://github.com/Yobing1/SolarView-vuln-/assets/135513064/c392da59-c285-4c28-98dd-ff29160b688c)

File Snapshot


 [4.0K]  /data/pocs/46f693514b796bbc11d25de01c752f66aa235a94
└── [ 799]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!