CVE-2016-20028

EIP tracks 1 public exploit for CVE-2016-20028. PoCs published by LiquidWorm.

AI-analyzed exploit summary This HTML file demonstrates a CSRF vulnerability in ZKTeco ZKBioSecurity 3.0, allowing an attacker to create a superadmin account via a crafted POST request. The exploit submits a form with hidden fields to the vulnerable endpoint without requiring user interaction beyond visiting the malicious page.

ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access when authenticated users visit attacker-controlled pages.