0X1911

An issue was discovered that allows a remote unauthenticated attacker to retrieve the content of its own session files due to an incorrect web server configuration. Each session file contains administrative LDAP credentials encoded in a reversible format. Sessions are stored in /sessions/sess <sessionid>.

An issue allows an authenticated remote attacker with elevated privileges in the Web Directory component on port 389 to upload a PHP file, achieving Remote Code Execution as SYSTEM.

A remote unauthenticated attacker can exploit a combination of directory traversal and insecure file upload vulnerabilities to achieve Remote Code Execution as SYSTEM. The directory traversal vulnerability is located in the ` construct()` function, while the insecure file upload vulnerability is found in the `SetSkinImages()` function.