DSK Systems DSKNet 2.16.136.0
Approved changes feed: RSS · Atom
cpe:2.3:a:dsk:dsknet:2.16.136.0:*:*:*:*:*:*:*part: a version: 2.16.136.0 update: *
| Vendor | Dsk (30e3c124-fd4d-5b48-8572-237d21f82fb7) |
|---|---|
| Product | Dsknet (2bbbb8f8-c7ee-5b1e-b0fb-0e2fe2511e16) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-24692 |
vulnerable | 2026-06-08 05:41:01.382229 |
Details available
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code delivery, with the final goal of achieving client-side code execution.
Published: 2022-07-18T12:34:40.000Z
Updated: 2024-08-03T04:20:49.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24691 |
vulnerable | 2026-06-08 05:41:01.381889 |
Details available
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based.
Published: 2022-07-18T12:34:34.000Z
Updated: 2024-08-03T04:20:49.796Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24690 |
vulnerable | 2026-06-08 05:41:01.381555 |
Details available
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data and extract sensitive information via crafted HTTP requests. The type of SQL Injection is blind boolean based. (An unauthenticated attacker can discover the endpoint by abusing a Broken Access Control issue with further SQL injection attacks to gather all user's badge numbers and PIN codes.)
Published: 2022-07-18T12:34:29.000Z
Updated: 2024-08-03T04:20:50.088Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24689 |
vulnerable | 2026-06-08 05:41:01.381195 |
Details available
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information pages (including personal data) without being authenticated. The collected information includes the badge numbers that operate as user login names. They have a PIN code. The PIN code is 4 digits and thus can be guessed in 10000 brute force attempts.
Published: 2022-07-18T12:34:24.000Z
Updated: 2024-08-03T04:20:50.187Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24688 |
vulnerable | 2026-06-08 05:41:01.379915 |
Details available
An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.
Published: 2022-07-18T12:34:18.000Z
Updated: 2024-08-03T04:20:49.788Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.