Privilege Escalation Vulnerability in ZKTime Web Software by ZKTeco

CVE-2017-17056

What is CVE-2017-17056?

The ZKTime Web Software version 2.0.1.12280 contains a vulnerability that enables an attacker to escalate their privileges through a crafted CSRF link. By exploiting the application's password_change() function, an attacker can trick an administrator into executing a malicious request. This allows the attacker, initially a normal user, to obtain administrative access and control over the ZKTime Web Software by manipulating the modification of user passwords through specific URL parameters.

References