ZKTeco ZKAccess Security System 5.3.1 Stored XSS
Vulnerability Description
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-20032
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- LiquidWorm as Gjoko Krstic of Zero Science Lab
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5368.php
- https://cxsecurity.com/issue/WLB-2016090004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116479
- https://packetstormsecurity.com/files/138572
- https://www.exploit-db.com/exploits/40328/
- https://www.vulncheck.com/advisories/zkteco-zkaccess-security-system-stored-xss
More from ZKTeco Inc.
View All →Affected Vendor
ZKTeco Inc.
View all reports →