CVE-2018-8914

SQL injection vulnerability in UPnP DMA in Synology Media Server before 1.7.6-2842 and before 1.4-2654 allows remote attackers to execute arbitrary SQL commands via the ObjectID parameter.

Score

CVSS 3.0 9.8 Critical

Status

Modified - security@synology.com

Published

2018-05-10

Last modified

2024-09-16

Weaknesses

CWE-89

Affected products

• Media Server (Synology)

References

• https://www.synology.com/en-global/support/security/Synology_SA_18_04