Synology Photo Station up to 6.3/6.7.4 label.php Type sql injection

Summaryinfo

A vulnerability was found in Synology Photo Station up to 6.3/6.7.4 and classified as critical. Affected is an unknown function of the file label.php. Such manipulation of the argument Type as part of Parameter leads to sql injection. This vulnerability is uniquely identified as CVE-2017-11161. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Synology Photo Station up to 6.3/6.7.4 (Network Attached Storage Software). Affected by this issue is an unknown code of the file label.php. The manipulation of the argument type as part of a Parameter leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

The bug was discovered 08/03/2017. The weakness was disclosed 09/08/2017 (Website). The advisory is shared for download at synology.com. This vulnerability is handled as CVE-2017-11161 since 07/10/2017. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

The vulnerability was handled as a non-public zero-day exploit for at least 36 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:label.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.3-2968 or 6.7.4-3433 eliminates this vulnerability.

The entries VDB-106293 and VDB-106295 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Attached Storage Software

Vendor

• Synology

Name

• Photo Station

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4

License

• commercial

Website

• Vendor: https://www.synology.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion