CVE-2018-8914 SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Synology media server | >= 1.4, < 1.4-2654 | 1.4-2654 |
| Synology media server | >= 1.7, < 1.7.6-2842 | 1.7.6-2842 |
| Synology media server | < 1.7.6-2842 | 1.7.6-2842 |
| Synology media server | < 1.4-2654 | 1.4-2654 |
References
- www.synology.com vendor-advisory