PT-2023-1590 · Unknown · Solarview Compact

Timorlover · Published 2023-02-06 · Updated 2025-06-03 · CVE-2023-23333

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarView Compact versions 6.00 and earlier

Description The issue is related to a command injection vulnerability, which allows attackers to execute commands by bypassing internal restrictions through the downloader.php endpoint. This is due to the lack of input data sanitization measures. The vulnerability can be exploited by a remote attacker to execute arbitrary commands.

Recommendations For SolarView Compact versions 6.00 and earlier, consider disabling access to the downloader.php endpoint until a patch is available. Restricting input data to prevent command injection is also recommended. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-01084

CVE-2023-23333

Affected Products

Solarview Compact

References · 21

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/solarview_unauth_rce_cve_2023_23333.rb · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2023-23333 · Exploit
• 🔥 https://github.com/Timorlover/CVE-2023-23333 · Exploit
• 🔥 https://github.com/emanueldosreis/nmap-CVE-2023-23333-exploit · Exploit
• 🔥 https://exploit-db.com/exploits/51886 · Exploit
• https://osv.dev/vulnerability/CVE-2023-23333 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01084 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23333 · Security Note
• https://t.me/aptreports/19164 · Telegram Post
• https://vuldb.com/ru/?id.220302 · Note
• https://t.me/cybersecuritytechnologies/7706 · Telegram Post
• https://t.me/cibsecurity/57622 · Telegram Post
• https://t.me/cybersecuritytechnologies/8777 · Telegram Post
• https://t.me/aptreports/7232 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592741938708757 · Twitter Post