Synology Photo Station Multiple Security Vulnerabilities
BID:74816
Info
Synology Photo Station Multiple Security Vulnerabilities
| Bugtraq ID: | 74816 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4656 |
| Remote: | Yes |
| Local: | No |
| Published: | May 25 2015 12:00AM |
| Updated: | Jul 15 2015 12:38AM |
| Credit: | Han Sahin |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Synology Photo Station Multiple Security Vulnerabilities
Synology Photo Station is prone to multiple security vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. A command-injection vulnerability
Attackers may exploit these issues to execute arbitrary commands and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Synology Photo Station 6.2-2858 is vulnerable; other versions may also be affected.
Synology Photo Station is prone to multiple security vulnerabilities, including:
1. Multiple cross-site scripting vulnerabilities
2. A command-injection vulnerability
Attackers may exploit these issues to execute arbitrary commands and execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible.
Synology Photo Station 6.2-2858 is vulnerable; other versions may also be affected.
Exploit / POC
Synology Photo Station Multiple Security Vulnerabilities
Attackers can exploit these issues through a browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit cross-site scripting issues.
The researcher has created proof-ofconcepts to demonstrate these issues. Please see the references for more information.
Attackers can exploit these issues through a browser. An attacker must trick an unsuspecting victim into following a malicious URI to exploit cross-site scripting issues.
The researcher has created proof-ofconcepts to demonstrate these issues. Please see the references for more information.
Solution / Fix
Synology Photo Station Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Synology Photo Station Multiple Security Vulnerabilities
References:
References:
- Synology Photo Station Homepage (Synology )