Exploitation Summary
EIP tracks 1 public exploit for CVE-2016-20032. PoCs published by LiquidWorm.
AI-analyzed exploit summary This HTML file contains a functional proof-of-concept for a stored XSS vulnerability in ZKTeco ZKAccess Security System 5.3.1. It demonstrates how unsanitized input in the 'holiday_name' and 'memo' POST parameters can execute arbitrary JavaScript in the context of the affected site.
Description
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code in these parameters to compromise user browser sessions and steal sensitive information.
Exploits (1)
This HTML file contains a functional proof-of-concept for a stored XSS vulnerability in ZKTeco ZKAccess Security System 5.3.1. It demonstrates how unsanitized input in the 'holiday_name' and 'memo' POST parameters can execute arbitrary JavaScript in the context of the affected site.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N