CVE-2016-10329

Published: May 12, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.

Vendor	Product	Versions
Synology	Synology Photo Station	affected `All versions prior to version 6.5.3-3226`

Weaknesses (CWE)

CWE-77

References

https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226

x_refsource_CONFIRM

https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password

x_refsource_MISC

https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution

x_refsource_MISC

[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2016-10329

Description

Affected Products

Weaknesses (CWE)

References