CVE-2023-23333

🗓️ 06 Feb 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 153 Views🌐 WEB

Command injection vulnerability in SolarView Compact, attackers can bypass internal restrictions via downloader.php

Reporter	Title	Published	Views	Family All 22
zdt	SolarView Compact 6.00 Remote Command Execution Exploit	6 Sep 202300:00	–	zdt
zdt	SolarView Compact 6.00 - Command Injection Exploit	14 Mar 202400:00	–	zdt
GithubExploit	Exploit for Command Injection in Contec Solarview_Compact_Firmware	1 Aug 202316:24	–	githubexploit
GithubExploit	Exploit for Command Injection in Contec Solarview_Compact_Firmware	16 Jun 202314:33	–	githubexploit
BDU FSTEC	The vulnerability of the microprogramming software of the SolarView Compact device, which is used for measuring solar energy, data display, and storage, stems from the lack of measures to clean incoming data. This allows a malicious individual to execute arbitrary commands.	6 Mar 202300:00	–	bdu_fstec
Circl	CVE-2023-23333	7 Feb 202300:23	–	circl
CNNVD	Contec SolarView Compact 命令注入漏洞	6 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-23333	6 Feb 202300:00	–	cvelist
Exploit DB	SolarView Compact 6.00 - Command Injection	14 Mar 202400:00	–	exploitdb
Japan Vulnerability Notes	Multiple vulnerabilities in CONTEC SolarView Compact	27 May 202206:28	–	jvn

NVD

Node

AND

Source	Link
github	www.github.com/Timorlover/CVE-2023-23333
packetstormsecurity	www.packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html

Parameter	Position	Path	Description	CWE
file	query param	/downloader.php	Command injection via downloader.php allowing arbitrary command execution.	CWE-77
;#{cmd};.zip	query param	/downloader.php	Command injection via downloader.php allowing arbitrary command execution.	CWE-77
@post_param	request body	/tmp/<webshell_name>	Webshell upload via POST to the PHP payload placed in tmp directory; used to execute commands.	CWE-77

17 Jun 2026 05:36Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.99273

SSVC