SolarView Compact 6.0 Command Injection

Exploit Title: SolarView Compact 6.0 - OS Command Injection Date: 2022-05-15 Exploit Author: Ahmed Alroky Author Company : AIactive Version: ver.6.00 Vendor home page : https://www.contec.com/ Authentication Required: No CVE : CVE-2022-29303 Tested on: Windows Exploit HTTP Request : POST...

SolarView Compact 6.0 - OS Command Injection

Exploit Title: SolarView Compact 6.0 - OS Command Injection Date: 2022-05-15 Exploit Author: Ahmed Alroky Author Company : AIactive Version: ver.6.00 Vendor home page : https://www.contec.com/ Authentication Required: No CVE : CVE-2022-29303 Tested on: Windows Exploit HTTP Request : POST...

CVE-2022-29302

SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...

CVE-2022-29303

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...

CVE-2022-29298

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal...

CVE-2022-29298

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal...

CVE-2022-29302

SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...

CVE-2022-29298

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal...

CVE-2022-29303

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...

CVE-2022-29302

SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...

Design/Logic Flaw

SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...

Directory traversal

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal...

Command injection

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...

CVE-2022-29303

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...

CVE-2022-29303

CVE-2022-29303 targets SolarView Compact (CONTEC). Affected: ver.6.00; vulnerability in the web server’s conf_mail.php allows OS command injection due to improper input validation on the send test mail console. Impact per sources: potential remote execution of arbitrary commands with high confide...

CVE-2022-29303

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via confmail.php...

CVE-2022-29302

SolarView Compact ver.6.00 was discovered to contain a local file disclosure via /html/SolarFtp.php...

CVE-2022-29302

CVE-2022-29302 affects SolarView Compact ver.6.00. The vulnerability is a local file disclosure via the hidden page at /html/Solar_Ftp.php, allowing a remote attacker to read and/or alter arbitrary files on the web server (local file disclosure). The related documents confirm this vulnerability a...

CVE-2022-29298

SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal...

CVE-2022-29298

Summary (CVE-2022-29298) SolarView Compact ver.6.00 is vulnerable to local file inclusion via directory traversal on the product web server (download page). The vulnerability stems from improper validation of the URL parameter on the download page, potentially allowing an attacker to view or obta...