CVE-2026-108794: ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation can be performed remotely and does not require user interaction.
What security impact could successful exploitation have?
The reported CVSS metrics indicate low impact to confidentiality, integrity, and availability. The vulnerability is classified as SQL injection, so successful exploitation may allow manipulation of database queries through the affected database-migration settings functionality.
Which deployment should be prioritized for investigation?
Prioritize ZKTeco BioTime 9.5.6 Build 20260130.3206 instances where low-privileged users can reach the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint remotely. The available information does not state whether this endpoint is enabled or reachable in a default configuration.
Is a vendor fix or workaround available?
The provided information does not identify a patch, fixed release, or workaround. It states that the vendor was contacted but did not respond.