Description
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Problem types
Files or Directories Accessible to External Parties
Product status
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab
References
www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php (Zero Science Lab Disclosure)
cxsecurity.com/issue/WLB-2016080265 (CXSecurity)
exchange.xforce.ibmcloud.com/vulnerabilities/116486 (IBM X-Force Exchange)
packetstormsecurity.com/files/138566 (Packet Storm Security)
www.exploit-db.com/exploits/40323/ (Reference)
www.vulncheck.com/...ege-escalation-via-insecure-permissions (VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions)