Esmaeil Rahimian

The issue allows remote attackers to read the web.config file, which can lead to the discovery of database credentials. This is achieved via the "/GetCSS.ashx/?CP=%2fweb.config" API endpoint.