PT-2022-16804

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue was discovered that allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind...

PT-2022-16802

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue allows unrestricted file upload, leading to Remote Code Execution, via PDF upload with PHP content and a .php extension in the Touch settings. The attacker must have...

PT-2022-16805

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue was discovered that allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of issue is blind boolean based...

PT-2022-16803

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description The issue concerns a mishandling of access control, allowing a remote attacker to access account information pages, including personal data, without authentication. The accessible...

CVE-2022-24689: Improper Restriction of Excessive Authentication Attempts

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages including personal data without being authenticated. The collected information includes the badge numbers that operate as user login...

PT-2022-16806

Name of the Vulnerable Software and Affected Versions DSK DSKNet versions 2.16.136.0 through 2.17.136.5 Description An issue was discovered in the new menu option within the general Parameters page, which is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every...

CVE-2022-24688: Unrestricted Upload of File with Dangerous Type

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload and consequently Remote Code Execution via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order...

CVE-2022-24690: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. An unauthenticated attacker...