CVE-2020-27660

CVE-2020-27660 is an SQL injection in Synology SafeAccess’ request.cgi that accepts a domain parameter and constructs an SQL query without proper escaping, enabling remote attackers to execute arbitrary SQL. The linked TALOS advisory TALOS-2020-1087 describes a SafeAccess SRM 1.2.1-0220 package s...

CVE-2020-27659

CVE-2020-27659 is corroborated by a TALOS advisory (TALOS-2020-1087) detailing an exploitable SQL injection in the SafeAccess SRM package (Synology SRM 1.2.3 RT2600ac with SafeAccess 1.2.1-0220). The vulnerability occurs in the request.cgi handling of the domain parameter, where user-controlled i...