Description
ZKTeco BioTime v8.5.5 是一款用于考勤管理的系统，其 iclock API 存在路径遍历漏洞。攻击者可以通过发送特制的请求，未经身份验证即可读取任意文件。这可能导致敏感信息泄露，例如系统配置文件或用户数据。
ZKTeco BioTime v8.5.5 /iclock/file 目录遍历漏洞（CVE-2023-38950）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-38950
https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38950.yaml
https://www.cve.org/CVERecord?id=CVE-2023-38950
https://pentest-tools.com/vulnerabilities-exploits/zkteco-biotime-v855-path-traversal_27171
https://www.tenable.com/cve/CVE-2023-38950
https://www.zkteco.com/en/Security_Bulletinsibs/10
https://krashconsulting.com/blog/fury-of-fingers-biotime-rce/
https://fortiguard.fortinet.com/encyclopedia/endpoint-vuln/6132
https://zone.ci/aliyun/ali_nvd/23696.html