CVE-2026-108794: SQL Injection in ZKTeco BioTime

This vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involves SQL injection in the database migration functionality exposed at /base/api/v1.0/systemSettings/db_migrate_setting/. Remote attackers can exploit this flaw to inject malicious SQL commands due to insufficient input validation or sanitization. The vendor was notified but has not provided any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

Successful exploitation could allow remote attackers with low privileges to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access or modification. However, the impact is limited as indicated by the CVSS vector, with low confidentiality, integrity, and availability impacts. No known exploits are reported in the wild.

No official fix or patch is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor the vendor's advisories for updates. Until a patch is released, consider restricting access to the affected API endpoint and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting this endpoint.