CVE-2015-6911

High

Published: 11/09/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

CVE-2015-6911 in Synology Video Station before version 1.5-0763 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the id parameter in watchstatus.cgi.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information or data manipulation.

Recommendation

It is recommended to update Synology Video Station to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Synology Video Station

See all

CVE-2015-6912High
Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
CVE-2015-6910High
CVE-2015-6910 is an SQL injection vulnerability in Synology Video Station before version 1.5-0757 that allows remote attackers to execute arbitrary SQL commands via the id parameter to audiotrack.cgi.

Original NVD description (English source)

SQL injection vulnerability in Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary SQL commands via the id parameter to watchstatus.cgi.