CVE-2022-29303

Summary dbcve.org

SolarView Compact version 6.00 contains an OS command injection vulnerability in conf_mail.php, allowing a remote, unauthenticated attacker to inject and execute arbitrary operating system commands on the underlying host. The CVSS 9.8 score indicates the flaw is network-exploitable with low attack complexity and requires no privileges or user interaction, resulting in full system compromise.

Mitigation

Upgrade SolarView Compact to a vendor-patched version if available; otherwise, apply input validation/sanitization to all parameters processed by conf_mail.php, avoid passing user input to shell command execution, and restrict network access to the management interface.