PT-2022-25397 · Zkbio · Zkbio Time

Aamir Rehman · Published 2022-09-29 · Updated 2025-05-20 · CVE-2022-40472

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZKBio Time version 8.0.7

Description A CSV injection issue allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.

Recommendations For version 8.0.7, consider disabling the Add New Message module until a patch is available to prevent exploitation of the CSV injection issue. Restrict access to the Content text field to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-40472

Affected Products

Zkbio Time

References · 5

• 🔥 https://the-it-wonders.blogspot.com/2022/09/zkbio-time-csv-injection.html · Exploit
• https://osv.dev/vulnerability/CVE-2022-40472 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40472 · Security Note
• https://t.me/cvenotify/123135 · Telegram Post
• https://t.me/cibsecurity/50744 · Telegram Post