CVE-2022-24692: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code...

DSK DSKNet SQL Injection Vulnerability

DSK DSKNet is a data interaction program from DSK Japan. Their time and attendance data can be accessed interactively from any site connected to your network. A security vulnerability exists in DSK DSKNet versions 2.16.136.0 and 2.17.136.5, which stems from a SQL injection vulnerability that allo...

PT-2022-16803

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description The issue concerns a mishandling of access control, allowing a remote attacker to access account information pages, including personal data, without authentication. The accessible...

PT-2022-16802

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue allows unrestricted file upload, leading to Remote Code Execution, via PDF upload with PHP content and a .php extension in the Touch settings. The attacker must have...

DSK DSKNet security vulnerabilities

DSK DSKNet is a data interaction program from DSK Japan. Their time and attendance data can be accessed interactively from any site connected to your network. A security vulnerability exists in DSK DSKNet versions 2.16.136.0 and 2.17.136.5, which stems from incorrectly handled access control, whi...

CVE-2022-24688: Unrestricted Upload of File with Dangerous Type

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

CVE-2022-24691: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based...

PT-2022-16805

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue was discovered that allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of issue is blind boolean based...