A vulnerability in ZKTeco BioTime’s database migration functionality permits attackers to manipulate the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint, resulting in SQL injection. The flaw is exploitable remotely and can enable execution of arbitrary database queries, potentially exposing, altering, or removing sensitive data stored in the system. The weakness is identified as an SQL injection flaw, classified under CWEs 74 and 89.

The affected product is ZKTeco BioTime version 9.5.6 Build 20260130.3206. Only this build of the BioTime software is known to contain the unpatched sql injection vulnerability in the database migration feature.

The CVSS score of 5.3 indicates a medium severity risk. The EPSS score of 0.00196 (<1%) indicates a very low probability of exploitation, though the vulnerability is accessible from the internet through the specified API, implying that an external attacker could exploit it without local access. The feature is not listed in the CISA KEV catalog, so no common exploitation has been documented yet. Without mitigation, the flaw provides a pathway for attackers to compromise data integrity and confidentiality across the entire BioTime database environment.