Command injection vulnerability in Synology Photo Station

Command injection vulnerability in Synology Photo Station

Han Sahin, May 2015

Abstract

A command injection vulnerability was found in Synology Photo Station,
which allows an attacker to execute arbitrary commands with the
privileges of the webserver. An attacker can use this vulnerability to
compromise a Synology DiskStation NAS, including all data stored on the
NAS.

Tested version

This issue was tested on Synology Photo Station version 6.2-2858.

Fix

Synology reports that this issue has been resolved in Photo Station
version 6.3-2945.
https://www.synology.com/en-us/releaseNote/PhotoStation

Details

https://www.securify.nl/advisory/SFY20150502/command_injection_vulnerability_in_synology_photo_station.html