CVE-2020-36195 SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On
Remote attackers can exploit SQL injection in QNAP NAS Multimedia Console or Media Streaming add-on to obtain application information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36195?
CVE-2020-36195 is a critical SQL injection vulnerability in Qnap Qts, published on 17 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia Console and the Media Streaming add-on. QTS 4.3.3: Media Streaming add-on 430.1.8.10 and later QTS 4.3.6: Media Streaming add-on 430.1.8.8 and later QTS 4.4.x and later: Multimedia Console 1.3.4 and later We have also fixed this vulnerability in the following versions of QTS 4.3.3 and QTS 4.3.6, respectively: QTS 4.3.3.1624 Build 20210416 or later QTS 4.3.6.1620 Build 20210322 or later
Which versions are affected by CVE-2020-36195?
It affects 3 products.
Products include Qnap Media Streaming Add-On, Qnap Multimedia Console, Qnap Qts.
How do I fix CVE-2020-36195?
No fix has been published for CVE-2020-36195 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-36195 being exploited?
There is no known exploitation of CVE-2020-36195 in the wild and no public exploit code.
Other vulnerabilities in Qnap Qts
- CVE-2017-7640 Command injection in QNAP Media Streaming Add-On
- CVE-2023-47222 Media Streaming add-on
- CVE-2023-23369 QTS, Multimedia Console, and Media Streaming add-on
- CVE-2017-7641 Cross-site request forgery in QNAP Media Streaming Add-On
- CVE-2021-34362 Command Injection Vulnerability in Media Streaming Add-on
Sources
Also known as GHSA-w8v9-r423-9xg2.