← Advisories

ZKTeco ZKAccess Security System 5.3.1 Stored XSS Vulnerability

Medium
Advisory ID
ZSL-2016-5368
Release Date
31 August 2016
Vendor
ZKTeco Inc. - http://www.zkteco.com
Affected Version
5.3.12252
Tested On
CherryPy/3.1.0beta3 WSGI Server, Firmware: AC Ver 4.1.9 3893-07 Jan 6 2016, Python 2.6
Summary

ZKAccess Systems are built on flexible, open technology to provide management, real-time monitoring, and control of your access control system-all from a browser, with no additional software to install. Our secure Web-hosted infrastructure and centralized online administration reduce your IT costs and allow you to easily manage all of your access points in a single location. C3-100's versatile design features take care of present and future needs with ease and efficiency. It is one of the most rugged and reliable controllers on the market, with a multitude of built-in features. The C3-100 can communicate at 38.4 Kbps via RS-485 configuration or Ethernet TCP/IP networks. It can store up to 30,000 cardholders.

Description

Input passed to the 'holiday_name' and 'memo' POST parameters is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Proof of Concept
Disclosure Timeline
18.07.2016Vulnerability discovered.
27.07.2016Vendor contacted.
29.08.2016No response from the vendor.
31.08.2016Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
31.08.2016Initial release
26.09.2016Added reference [1], [2], [3] and [4]
24.03.2026Added reference [5]