CVE-2023-38952 PoC — ZKTeco BioTime 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38952.yaml

Associated Vulnerability

Title:ZKTeco BioTime 安全漏洞 (CVE-2023-38952)
Description:Zkteco BioTime是中国Zkteco公司的一款功能强大的基于 web 的时间和出勤管理软件。 ZKTeco BioTime v8.5.5版本存在安全漏洞，该漏洞源于允许未经身份验证的攻击者通过向系统的静态文件资源发送精心设计的 HTTP 请求来读取敏感备份文件并访问用户凭据等敏感信息。

Description

BioTime default employee credentials (password 123456) allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files.

File Snapshot


 id: CVE-2023-38952

info:
  name: ZKTeco BioTime <= 9.0.1 - Privilege Escalation
  author: riteshs4h

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!