← Advisories

SOCA Access Control System 180612 CSRF Add Admin Exploit

Medium
Advisory ID
ZSL-2019-5520
Release Date
13 May 2019
Vendor
SOCA Technology Co., Ltd - http://www.socatech.com
Affected Version
180612, 170000, 141007
Tested On
Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586, Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586, Apache/2.2.22 (Win32), PHP/5.4.13
Summary

The company's products include proximity and fingerprint access control system, time and attendance, electric locks, card reader and writer, keyless entry system and other 30 specialized products. All products are attractively designed with advanced technology in accordance with users' safety and convenience which also fitted international standard.

Description

The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
13.05.2019Initial release
15.05.2019Added reference [4]
21.03.2026Added reference [5]