ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions
Posted by deepcore on September 1, 2016 – 12:55 pm
ZKTime.Net suffers from an elevation of privileges vulnerability which can be used by a simple user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the ‘C’ flag (Change) for ‘Everyone’ group, making the entire directory ‘ZKTimeNet3.0’ and its files and sub-dirs world-writable. Version 3.0.1.6 is affected.
Post a reply
You must be logged in to post a comment.