CVE-2017-13129

HIGH

ZKTeco ZKTime Web 2.0.1.12280 - Authenticated Cross-Site Request Forgery

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-13129. PoCs published by Arvind V.

AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in ZKTime Web Software 2.0, allowing an attacker to escalate privileges to administrator by tricking an authenticated admin into submitting a forged HTTP request.

Description

Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators by leveraging lack of anti-CSRF tokens.

Exploits (1)

exploitdb WORKING POC

by Arvind V · htmlwebappswindows

https://www.exploit-db.com/exploits/43018

View Code ZIP pw:eip

This exploit demonstrates a CSRF vulnerability in ZKTime Web Software 2.0, allowing an attacker to escalate privileges to administrator by tricking an authenticated admin into submitting a forged HTTP request.

Classification

Working Poc 90%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: ZKTime Web Software 2.0.1.12280

Auth required

Prerequisites: Authenticated administrator session · Victim interaction (clicking a malicious link)

MITRE ATT&CK

T1189 - Drive-by Compromise T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2017/Sep/38

Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq

http://seclists.org/bugtraq/2017/Sep/19

Scores

CVSS v3 8.0

EPSS 0.0016

EPSS Percentile 36.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

zkteco/zktime_web 2.0.1.12280

Published Sep 26, 2017

Tracked Since Feb 18, 2026