CVE-2023-28343

OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

84.75% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-78

Published

2023-03-14

Updated

2025-02-27

Proof-of-concept exploits (3)

• ahmedalroky/Disclosures/blob/main/apesystems/os_command_injection.md
• gobysec/CVE-2023-283436★ · 2023-03-22
• superzerosec/CVE-2023-283438★ · 2023-03-23

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-28343.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51325

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-28343.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2023-23063
• CVE-2023-31502
• CVE-2019-0708
• CVE-2023-1454
• CVE-2023-21931
• CVE-2023-28432