PT-2017-11786 · Synology · Synology Photo Station

Published 2017-09-08 · Updated 2019-10-09 · CVE-2017-11161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.7.4-3433 Synology Photo Station versions prior to 6.3-2968

Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the article id parameter to "label.php" or the type parameter to "synotheme.php".

Recommendations For versions prior to 6.7.4-3433, update to version 6.7.4-3433 or later. For versions prior to 6.3-2968, update to version 6.3-2968 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-11161

Affected Products

Synology Photo Station

References · 3

• https://synology.com/en-global/support/security/Synology_SA_17_35_PhotoStation · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11161 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11161 · Vendor Advisory