FDS vulnerabilities

An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.

An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.

A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.