PT-2023-1590 · Unknown · Solarview Compact

Timorlover

·

Publicado

2023-02-06

·

Atualizado

2025-06-03

·

CVE-2023-23333

CVSS v3.1

10

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SolarView Compact versions 6.00 and earlier
Description The issue is related to a command injection vulnerability, which allows attackers to execute commands by bypassing internal restrictions through the downloader.php endpoint. This is due to the lack of input data sanitization measures. The vulnerability can be exploited by a remote attacker to execute arbitrary commands.
Recommendations For SolarView Compact versions 6.00 and earlier, consider disabling access to the downloader.php endpoint until a patch is available. Restricting input data to prevent command injection is also recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-01084
CVE-2023-23333

Produtos afetados

Solarview Compact