CVE-2023-28343
CRITICAL EXPLOITED NUCLEIAPSystems Energy Communication Unit Firmware C1.2.5 - OS Command Injection via Timezone Parameter
Title source: llmExploitation Summary
CVE-2023-28343 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including Ahmed Alroky, superzerosec, gobysec. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit leverages an OS command injection vulnerability in Altenergy Power Control Software C1.2.5 via the timezone parameter in a POST request to execute arbitrary commands, resulting in a reverse shell.
Description
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
Exploits (4)
This exploit leverages an OS command injection vulnerability in Altenergy Power Control Software C1.2.5 via the timezone parameter in a POST request to execute arbitrary commands, resulting in a reverse shell.
This repository contains a functional exploit for CVE-2023-28343, which leverages command injection in the 'timezone' parameter of a PHP endpoint to achieve remote code execution (RCE). The exploit uses a reverse shell payload delivered via netcat, with optional automatic external IP detection for the listener.
The repository lacks actual exploit code and instead directs users to external platforms (GitHub issues, Telegram, WeChat) for further engagement. The README contains no technical details about the vulnerability, only a generic description and marketing language.
This repository contains a functional exploit for CVE-2023-28343, an OS command injection vulnerability in Altenergy Power Control Software. The exploit leverages insufficient input validation in the timezone parameter to achieve remote code execution.
Nuclei Templates (1)
title:"Altenergy Power Control Software" || http.title:"altenergy power control software"
title="altenergy power control software"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H