system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import game
import qrcode
import socket
import uuid
import hashlib
import pygame
from pygame.locals import *
import urllib.request
import json
import ssl
import time
import threading

WINDOW_WIDTH = 400
WINDOW_HEIGHT = 600
WHITE = (255, 255, 255)
BLACK = (0, 0, 0)
FONT_SIZE = 30

startGame = game.main
clientId = None
connectUser = None
requestFlag = True

ssl._create_default_https_context = ssl._create_unverified_context

def getMacAddress():
    hostname = socket.gethostname()
    ip = socket.gethostbyname(hostname)
    mac=uuid.UUID(int = uuid.getnode()).hex[-12:]
    return ":".join([mac[e:e+2] for e in range(0,11,2)])

def genClientId():
    md5 = hashlib.md5()
    macAddr = getMacAddress()
    md5.update(macAddr.encode('utf8'))
    return md5.hexdigest()

def terminate():
    global connectUser, requestFlag
    pygame.quit()
    requestFlag = False
    if connectUser != None:
        startGame(connectUser)
    else:
        quit()

def drawText(text, font, surface, x, y):
    textobj = font.render(text, 1, BLACK)
    textrect = textobj.get_rect()
    textrect.topleft = (x, y)
    surface.blit(textobj, textrect)

def isReadyToPlay():
    global connectUser, clientId, requestFlag
    while requestFlag:
        try:
            response=urllib.request.urlopen('https://forrestlin.cn/games/isReadyToPlay/%s'%clientId)
            res = response.read().decode('utf-8')
            resJson = json.loads(res)
            if resJson['success']: 
                print('connect success, userId = %s\n'%resJson['user']['userId'])
                connectUser = resJson['user']
                requestFlag = False
            else:
                print('connect failed')
        except urllib.error.URLError as e:
            if isinstance(e.reason, socket.timeout):
                print('TIME OUT')
        
        time.sleep(2)

def intro():
    global clientId, connectUser
    pygame.init()
    pygame.display.set_caption('最强大脑')
    screen = pygame.display.set_mode((WINDOW_WIDTH, WINDOW_HEIGHT))
    clock = pygame.time.Clock()
    pygame.draw.rect(screen, WHITE, (0, 0, WINDOW_WIDTH, WINDOW_HEIGHT))

    clientId = genClientId()
    qrImg = qrcode.make('alicia:%s'%clientId)
    qrImg.save('clientId.png')
    clientImg = pygame.image.load('clientId.png')
    clientImg = pygame.transform.scale(clientImg, (WINDOW_WIDTH, WINDOW_WIDTH))
    screen.blit(clientImg, (0, 0))

    font = pygame.font.SysFont('simsunnsimsun', FONT_SIZE)
    drawText(u'扫码进入游戏', font, screen, (WINDOW_WIDTH - FONT_SIZE * 6) / 2, 450)

    pygame.display.update()

    t = threading.Thread(target=isReadyToPlay)
    t.start()
    while True:
        for event in pygame.event.get():
            if event.type == QUIT:
                terminate()
            if event.type == KEYDOWN:
                if event.key == K_ESCAPE: #escape quits
                    terminate()
        if connectUser != None:
            terminate()
        clock.tick(60)
    

if __name__ == "__main__":
    intro()

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  B) CWE-312: Cleartext Storage of Sensitive Information
  C) CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  D) CWE-117: Improper Output Neutralization for Logs
  E) CWE-94: Improper Control of Generation of Code ('Code Injection')
  F) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Answer: C