A county download endpoint accepts a file path parameter and returns document contents with little sanitization. What vulnerability class should the tester prioritize investigating?
Select an answer to reveal the explanation.
Short Explanation
If the app lets you name the file it opens, you might talk it into opening the wrong drawer. Path traversal and LFI are that wrong-drawer problem — unsanitized path params can spill config and secrets. You are classifying the risk, not dumping a scavenger hunt of filenames.
Full Explanation
A download endpoint that accepts a file path parameter with little sanitization should be investigated primarily for local file inclusion or path traversal. For a county document service, crafted paths may read configuration, keys, or other sensitive files from the server filesystem—directly threatening confidentiality of municipal data and credentials that unlock further access.
Open redirect via Location headers is a different class centered on navigation abuse. Password spraying the VPN is unrelated to the download path parameter. SMTP header injection concerns outbound mail, not file-path downloads.
Exam caveat: distinguish LFI/path traversal (read local files) from RFI (include remote) and from XSS; prove with minimal, non-destructive file reads authorized by RoE. CPTS web findings should name the parameter and impact without unnecessary sensitive file dumps.
Operational check: attempt controlled traversal proofs to known harmless files if permitted, confirm sanitization/allowlisting of civic document roots, store downloads outside executable web roots, and retest after path canonicalization controls. Restrict download roots to an allowlisted county document store and deny raw filesystem path parameters from ever reaching OS open calls.