High · 7.5 CVE-2024-50631 EUVD-2024-54100GHSA-32wq-rmxf-3mf7

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology…

Published Mar 19, 2025 · Updated Mar 19, 2025 · Assigned by synology

Vendor: Synology Product: Synology Drive Server

Description

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.

Affected products

Vendor	Product	Affected	Fixed
Synology	Synology Drive Server	< 3.5.1-26102, < 3.5.0-26085, < 3.2.1-23280, < 3.0.4-12699	3.5.1-26102

References

Synology-SA-24:21 Synology Drive Server (PWN2OWN 2024) vendor-advisory