Critical · published February 23, 2024
🚨 With a predictable timestamp, attackers can easily snatch database backups from ZKteco’s ZKBio WDMS! 🔥 Think of this like a hotel’s guest list where the check-in times are posted outside. If you can guess the times, you can easily figure out which guests are coming and going, potentially stealing confidential information! If exploited, an attacker could gain access to sensitive database backups, exposing critical data like user information and credentials. This could lead to identity theft, data breaches, and absolute chaos for any organization relying on this software.
Think of this like a hotel’s guest list where the check-in times are posted outside. If you can guess the times, you can easily figure out which guests are coming and going, potentially stealing confidential information! This vulnerability arises from the /files/backup/ component, where the database backup filenames are generated based on a predictable timestamp, allowing attackers to easily guess and download these files.
If exploited, an attacker could gain access to sensitive database backups, exposing critical data like user information and credentials. This could lead to identity theft, data breaches, and absolute chaos for any organization relying on this software. Immediately upgrade ZKteco ZKBio WDMS to version 9.0.2 Build 20250526 or later to close this critical gap. Additionally, implement access controls to restrict who can access the backup files while you're at it. You've got this! Patch up and lock down your systems to keep your data safe. 🛡️