PT-2017-14690 · Zktime · Zktime Web

Publicado 2017-12-04 · Atualizado 2017-12-21 · CVE-2017-17057

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZKTime Web version 2.0.1.12280

Description The issue is related to insufficient filtration of user-supplied data in the Range field of the Department module in a Personnel Advanced Query. This allows a remote attacker to execute arbitrary HTML and script code in the browser in the context of the vulnerable application.

Recommendations For ZKTime Web version 2.0.1.12280, consider restricting access to the Department module in a Personnel Advanced Query to minimize the risk of exploitation. As a temporary workaround, avoid using the Range field in the vulnerable module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-17057

Produtos afetados

Zktime Web

Referências · 4

• 🔥 http://packetstormsecurity.com/files/145159/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-17057 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17057 · Nota de Segurança
• http://securityfocus.com/bid/102006 · Nota