| عنوان | ZKTeco BioTime 9.5.6 Build 20260130.3206 Information Disclosure / Broken Access Control |
|---|
| الوصف | A broken access control vulnerability in the system settings API of ZKTeco BioTime (ZKBioTime) 9.5.6 Build 20260130.3206 allows a low-privilege authenticated user to access database connection settings that should be restricted to authorized administrative users.
The endpoint /base/api/systemSettings/ is accessible to a low-privilege authenticated account and returns sensitive database configuration information, including the PostgreSQL host, port, database name, database username, and an encrypted database password.
The affected API exposes the db_migrate_setting configuration object containing migrate_database_address, migrate_database_port, migrate_database_name, migrate_database_user, and migrate_database_password. These database credentials are administrative configuration data and should not be disclosed to ordinary low-privilege users.
During testing, a low-privilege authenticated session was sufficient to request the endpoint and retrieve the database connection settings:
GET /base/api/systemSettings/
The response contains the database host, username, database name, and encrypted password without requiring administrative authorization.
The database password is encrypted using application-level cryptographic material that is present in the shipped application. Consequently, the exposed encrypted credential can be recovered when combined with the separate cryptographic weakness documented in the related hardcoded-key finding. The access-control vulnerability itself is the unauthorized disclosure of the database credential material through the systemSettings API.
The same systemSettings response also exposes other sensitive configuration values, including database backup configuration and the dynamic_qr_code_secretkey configuration.
The attack requires an authenticated BioTime account with low privileges. No victim interaction is required.
Affected component:
- System settings API
- /base/api/systemSettings/
Attack flow:
1. An attacker obtains or uses a low-privilege authenticated BioTime account.
2. The attacker sends an authenticated request to /base/api/systemSettings/.
3. BioTime returns administrative system configuration intended to be restricted.
4. The response exposes PostgreSQL database connection information and encrypted credential material.
5. The disclosed database connection information and credential material may enable direct access to the underlying application database if the database is reachable by the attacker and the password is recovered.
Impact:
Successful exploitation allows a low-privilege authenticated user to obtain sensitive database connection information and credential material. This can expose the confidentiality of the underlying BioTime database and provide an attacker with credentials that may enable direct database access, depending on network exposure and database permissions.
The issue was reported to ZKTeco through its security reporting channel. ZKTeco subsequently confirmed that its R&D team fixed this vulnerability. At the time of submission, the exact publicly released fixed version/build had not been provided.
CVSS v3.1: 7.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
CWE:
- CWE-284: Improper Access Control
- CWE-200: Exposure of Sensitive Information
- CWE-522: Insufficiently Protected Credentials |
|---|
| المستخدم | bashdar (UID 101020) |
|---|
| ارسال | 05/09/2026 01:00 AM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 11:11 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416572 [ZKTeco BioTime 9.5.6 Build 20260130.3206 System Settings API /base/api/systemSettings تجاوز الصلاحيات] |
|---|
| النقاط | 17 |
|---|