CVE-2022-31373

MEDIUMNuclei

SolarView Compact 6.00 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-31373 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSolarView Compact 6.00 - Cross-Site ScriptingCVSS 6.1

SolarView Compact 6.00 contains a cross-site scripting vulnerability via Solar_AiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to the latest version to mitigate this vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscve2022cvexsssolarviewcontecvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:contec:sv-cpt-mc310_firmware:6.0:*:*:*:*:*:*:*
Shodan: http.html:"SolarView Compact"
Shodan: http.html:"solarview compact"
FOFA: body="solarview compact"
https://github.com/badboycxcc/SolarView_Compact_6.0_xss https://nvd.nist.gov/vuln/detail/CVE-2022-31373 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates https://github.com/badboycxcc/badboycxcc

Source: ProjectDiscovery

References

2