Synology Photo Station multiple Cross-Site Scripting vulnerabilities

Synology Photo Station multiple Cross-Site Scripting vulnerabilities

Han Sahin, May 2015

Abstract

Multiple reflected Cross-Site scripting vulnerabilities were found in
Synology Photo Station. These issues allow attackers to perform a wide
variety of actions, such as stealing victims' session tokens or login
credentials if available, performing arbitrary actions on their behalf
but also performing arbitrary redirects to potential malicious websites.

Tested version

This issue was tested on Synology Photo Station version 6.2-2858.

Fix

Synology reports that this issue has been resolved in Photo Station
version 6.3-2945.
https://www.synology.com/en-us/releaseNote/PhotoStation

Details

https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html