CVE-2017-11161

Critical

Published: 08/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Multiple SQL injection vulnerabilities in Synology Photo Station before version 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

Risk Assessment

Attackers can exploit these vulnerabilities to gain access to sensitive data in the database, potentially leading to serious security breaches.

Recommendation

It is recommended to update Synology Photo Station to the latest version to eliminate these vulnerabilities and to monitor logs for potential attack attempts.

Original NVD description (English source)

Multiple SQL injection vulnerabilities in Synology Photo Station before 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.