CVE-2018-19952

Summary

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Affected Software

VendorProductVersion RangeStatus
QNAP Systems Inc.Music Stationunspecified < 5.1.13affected
QNAP Systems Inc.Music Stationunspecified < 5.2.9affected
QNAP Systems Inc.Music Stationunspecified < 5.3.11affected

Weaknesses

  • CWE-20: CWE-20 Improper Input Validation
  • CWE-80: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
  • CWE-943: CWE-943 Improper Neutralization of Special Elements in Data Query Logic

ADP Enrichment

CVE Program Container

Additional References

References