Vulnerabilities

The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system.

The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed.

The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.

An OS Command Injection vulnerability exists within myPRO Manager.

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.