Intrusion Prevention

Synology.Photo.Station.Type.Parameter.Unrestricted.File.Upload

Description

This indicates an attack attempt to exploit an Unrestricted File Upload vulnerability in Synology Photo Station.
The vulnerability is due to insufficient sanitizing of user supplied inputs in the application. A remote attacker may be able to exploit this to create arbitrary PHP scripts, leading to possible further attacks.

Affected Products

Photo Station before 6.7.3-3432 and 6.3-2967

Impact

Security Bypass: Remote attackers can bypass security features of vulnerable systems.

Recommended Actions

Refer to the vendor's advisory for updates:
https://www.synology.com/zh-tw/support/security/Synology_SA_17_34_PhotoStation

CVE References

CVE-2017-11154