Unknown application vulnerabilities

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES encryption keys, a Man-in-the-Middle attacker can decrypt network traffic.

A low-privileged remote attacker can enumerate all configured users and identify accounts with elevated privileges using the endpoint /api/user/fetch-all.php.

A low-privileged remote attacker with a valid session can create new user accounts with arbitrary role values, including the highest privilege level, using the /api/user/add.php endpoint.

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.

Due to a lack of authentication, an unauthenticated user can request data from this endpoint, making the application vulnerable to user enumeration.