Reza Rashidi

Name of the Vulnerable Software and Affected Versions: PNETLab version 4.2.10 Description: The issue arises from the application's failure to properly sanitize user inputs in its file access mechanisms, allowing attackers to perform directory traversal by manipulating file paths in HTTP requests. This enables access to sensitive files outside the intended directory. Recommendations: For PNETLab version 4.2.10, consider implementing proper input sanitation for file access mechanisms to prevent directory traversal attacks. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation.

The issue is related to insecure information storage. An attacker could exploit this to obtain the application password. The password is stored in the `/Users/user/Library/Application Support/ntfs-tool/config.json` file.

A problematic issue has been found in the processing of the file /core/config-revisions of the component Home Page Configuration. The manipulation with the input `<h1 onload=alert(1)>`test`</h1>` leads to cross site scripting. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified, which may allow an attacker to trick a client into making an unintentional request to the web server. This request will be treated as an authentic request, potentially leading the attacker to perform operations on behalf of the victimized user.

A weak cryptographic algorithm vulnerability has been identified, which can help an attacker compromise the confidentiality of sensitive data and may lead to unexpected authorization. The vulnerability is related to the use of defective cryptographic algorithms, allowing a remote attacker to gain unauthorized access to protected information.