{
  "Name": "QNAP Photo Station APP Local File Read (CVE-2019-7192)",
  "Description": "This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix these vulnerabilities, QNAP recommend updating Photo Station to their latest versions.",
  "Product": "QNAP",
  "Homepage": "https://www.qnap.com/en/app_releasenotes/list.php?app_choose=PhotoStation",
  "DisclosureDate": "2019-12-05",
  "Author": "ovi3",
  "FofaQuery": "app=\"QNAP-NAS\"",
  "Level": "3",
  "Impact": "This improper access control vulnerability allows remote attackers to gain unauthorized access to the system",
  "Recommendation": "updating QTS and Photo Station to their latest versions.",
  "References": null,
  "RealReferences": [
    "http://packetstormsecurity.com/files/157857/QNAP-QTS-And-Photo-Station-6.0.3-Remote-Command-Execution.html",
    "https://www.qnap.com/zh-tw/security-advisory/nas-201911-25",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-7192",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7192"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "filePath",
      "type": "input",
      "value": "./../../../../../share/Multimedia/.@__thumb/ps.app.token"
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": null,
  "CVEIDs": [
    "CVE-2019-7192"
  ],
  "CVSSScore": "9.8",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": ["QNAP-NAS"]
  },
  "Disable": false
}