Zkteco Zkbiosecurity CVE-2016-20028

The vulnerability exploits the absence of CSRF tokens or similar anti-CSRF mechanisms in ZKTeco ZKBioSecurity 3.0's administrative account creation endpoints. When a web application fails to validate that state-changing requests (such as adding users) originate from legitimate, authenticated sessions rather than cross-origin requests, it becomes vulnerable to CSRF attacks as defined by CWE-352. ZKBioSecurity is a biometric access control and time-attendance management platform deployed in enterprise environments, typically running on internal networks or cloud infrastructure. The absence of validity checks on superadmin account creation suggests that the application trusts the browser context of authenticated users implicitly, allowing an attacker to forge requests that the browser will automatically include with valid session cookies when the user visits a malicious site. This is a classic CSRF weakness in web applications handling sensitive operations without proper request origin validation or cryptographic tokens.