CVE-2022-29303criticalunder attackCWE-78

CVE-2022-29303

Published · Updated

Follow this CVE+ Monitor Compact

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 98%
from disclosure to weapon5 days
Published on NVDMay 12
1st PoC+5d
CISA KEV+427d
Action required by CISAfederal deadline: 2023-08-03

Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

In short

SolarView Compact version 6.00 allows attackers to inject and execute arbitrary commands through the conf_mail.php file. This can give attackers complete control over the affected system.

Technical detail

Command injection vulnerability in conf_mail.php enables unauthenticated or low-privileged attackers to execute arbitrary OS commands via unsanitized input parameters. The vulnerability exploits insufficient input validation in mail configuration functionality, resulting in remote code execution with system-level privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.