| शीर्षक | ZKTeco ZKBio CVSecurity 4.1.0 Stored Cross-Site Scripting |
|---|
| विवरण | A filter bypass was identified in the "Schedule Name" field (parameter name), resulting in a Stored Cross-Site Scripting (Stored XSS) vulnerability. This vulnerability allows a user with permissions to edit existing fields or add new fields in the system to inject malicious scripts. These scripts can steal cookies from administrators or other users, potentially escalating privileges or performing other malicious actions.
Proof of Concept (PoC):
1 - Edit or add a new summer schedule in Access / Access Device / Summer Schedule.
2 - In the "Summer Schedule Name" field, enter any string and intercept it with Burp Suite. In the "name" parameter, place the following payload, bypassing the filters:
"><img src=x onerror="alert``"
3 - Any user accessing the Schedule list will be affected by the Stored Cross-Site Scripting. |
|---|
| स्रोत | ⚠️ https://www.zkteco.com.br/zkbiocvsecurity/ |
|---|
| उपयोगकर्ता | Stux (UID 40142) |
|---|
| सबमिशन | 06/06/2024 08:26 PM (2 साल पहले) |
|---|
| संयम | 14/06/2024 05:31 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 268694 [ZKTeco ZKBio CVSecurity V5000 4.1.0 Summer Schedule Schedule Name क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|