CVE-2023-38950 PoC — Zkteco BioTime 路径遍历漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38950.yaml

Associated Vulnerability

Title:Zkteco BioTime 路径遍历漏洞 (CVE-2023-38950)
Description:Zkteco BioTime是中国Zkteco公司的一款功能强大的基于 web 的时间和出勤管理软件。 ZKTeco BioTime v8.5.5版本存在路径遍历漏洞，该漏洞源于允许未经身份验证的攻击者通过提供精心设计的有效负载来读取任意文件。

Description

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

File Snapshot


 id: CVE-2023-38950

info:
  name: ZKTeco BioTime v8.5.5 - Path Traversal
  author: iamnoooob,pdresea

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!