CVE-2023-23333

🗓️ 06 Feb 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 144 Views🌐 WEB

Command injection vulnerability in SolarView Compact, attackers can bypass internal restrictions via downloader.php

Reporter	Title	Published	Views	Family All 22
0day.today	SolarView Compact 6.00 Remote Command Execution Exploit	6 Sep 202300:00	–	zdt
0day.today	SolarView Compact 6.00 - Command Injection Exploit	14 Mar 202400:00	–	zdt
GithubExploit	Exploit for Command Injection in Contec Solarview_Compact_Firmware	1 Aug 202316:24	–	githubexploit
GithubExploit	Exploit for Command Injection in Contec Solarview_Compact_Firmware	16 Jun 202314:33	–	githubexploit
BDU FSTEC	The vulnerability of the microprogramming software of the SolarView Compact device, which is used for measuring solar energy, data display, and storage, stems from the lack of measures to clean incoming data. This allows a malicious individual to execute arbitrary commands.	6 Mar 202300:00	–	bdu_fstec
Circl	CVE-2023-23333	7 Feb 202300:23	–	circl
CNNVD	Contec SolarView Compact 命令注入漏洞	6 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-23333	6 Feb 202300:00	–	cvelist
Exploit DB	SolarView Compact 6.00 - Command Injection	14 Mar 202400:00	–	exploitdb
Japan Vulnerability Notes	Multiple vulnerabilities in CONTEC SolarView Compact	27 May 202206:28	–	jvn

NVD

Node

AND

Source	Link
github	www.github.com/Timorlover/CVE-2023-23333
packetstormsecurity	www.packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html

Parameter	Position	Path	Description	CWE
file	query param	downloader.php	Command injection via vulnerable downloader.php endpoint using a crafted file parameter.	CWE-77
<post_param>	request body	tmp/<webshell_name>	Webshell upload via POST to the temporary path to execute payload, enabling remote code execution.	CWE-77

17 Jun 2026 05:36Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.99273

SSVC