Description
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- ZKTeco BioTime <= 9.0.1 - Privilege Escalation http/cves/2023/CVE-2023-38952.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.