PT-2017-14690 · Zktime · Zktime Web

Published 2017-12-04 · Updated 2017-12-21 · CVE-2017-17057

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZKTime Web version 2.0.1.12280

Description The issue is related to insufficient filtration of user-supplied data in the Range field of the Department module in a Personnel Advanced Query. This allows a remote attacker to execute arbitrary HTML and script code in the browser in the context of the vulnerable application.

Recommendations For ZKTime Web version 2.0.1.12280, consider restricting access to the Department module in a Personnel Advanced Query to minimize the risk of exploitation. As a temporary workaround, avoid using the Range field in the vulnerable module until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-17057

Affected Products

Zktime Web

References · 4

• 🔥 http://packetstormsecurity.com/files/145159/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-17057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17057 · Security Note
• http://securityfocus.com/bid/102006 · Note