| Title | ZKTeco BioTime 9.5.6 Build 20260130.3206 SQL Injection |
|---|
| Description | A second-order SQL injection vulnerability in the database migration functionality of ZKTeco BioTime (ZKBioTime) 9.5.6 Build 20260130.3206 allows an authenticated attacker to execute arbitrary SQL statements, which can be chained to achieve operating-system command execution on the BioTime server.
The migration functionality allows an authenticated user to configure a source database connection using attacker-controlled connection parameters, enabling the attacker to cause BioTime to retrieve attacker-controlled database records during the migration process. The application subsequently retrieves database records from the configured source and constructs SQL INSERT statements for the local PostgreSQL database.
The retrieved database values are inserted into SQL statements using Python string formatting without appropriate escaping or parameterization. Because the source database can be controlled by the attacker, malicious values returned from the source database are subsequently interpreted as SQL syntax when the migration executes the generated statements against the local PostgreSQL database.
This creates a second-order SQL injection condition in which attacker-controlled data is stored in the external database first and later executed as SQL by the BioTime server.
During testing, the vulnerability was chained with PostgreSQL's COPY ... TO PROGRAM functionality to achieve operating-system command execution on the BioTime server. The resulting command execution was confirmed to execute with NT AUTHORITY\SYSTEM privileges on the tested default Windows installation.
The attack requires an authenticated BioTime account with access to the database migration functionality. No victim interaction is required.
Affected component:
- Database migration functionality
- /base/api/v1.0/systemSettings/db_migrate_setting/
- /base/api/v1.0/systemSettings/db_migrate_run/
Attack flow:
1. An authenticated attacker configures the migration source to an attacker-controlled database.
2. The attacker-controlled database returns a maliciously crafted record during migration.
3. BioTime incorporates the returned value into an SQL INSERT statement using unsafe string formatting.
4. The resulting SQL is executed against the local PostgreSQL database.
5. The injected SQL can invoke PostgreSQL COPY ... TO PROGRAM, resulting in operating-system command execution.
6. On the tested default Windows installation, the command executed as NT AUTHORITY\SYSTEM.
Impact:
Successful exploitation can result in remote code execution on the BioTime server with SYSTEM-level privileges, allowing an attacker to compromise the confidentiality, integrity, and availability of the affected server and potentially access or modify data handled by the BioTime installation.
The issue was reported to ZKTeco through its security reporting channel. ZKTeco subsequently confirmed that its R&D team fixed this vulnerability. At the time of submission, the exact publicly released fixed version/build had not been provided.
CVSS v3.1: 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CWE:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CWE-78: Improper Neutralization of Special Elements used in an OS Command |
|---|
| User | bashdar (UID 101020) |
|---|
| Submission | 09/05/2026 00:02 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416571 [ZKTeco BioTime 9.5.6 Build 20260130.3206 Database Migration Functionality db_migrate_setting sql injection] |
|---|
| Points | 17 |
|---|