CVE-2024-50631 - CVE House
Back to Database
Status published High CVE-2024-50631

Improper neutralization of special elements used in an SQL command...

Vulnerability Description

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, 3.5.0-26085 and 3.5.1-26102 allows remote attackers to inject SQL commands, limited to write operations, via unspecified vectors.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-50631

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Pumpkin Chang (@u1f383) and Orange Tsai (@orange_8361) from DEVCORE Research Team

References

More from Synology

View All →
CVE-2025-8074
Origin validation error vulnerability in BeeDrive in Synology BeeDrive for...
Medium 5.6
CVE-2025-66593
An origin validation error vulnerability in Synology Assistant before 7.0.6-50085...
Medium 6.1
CVE-2025-66592
An origin validation error vulnerability in Synology Active Backup for...
Medium 6.1
CVE-2025-54160
Improper limitation of a pathname to a restricted directory ('Path...
High 7.8
CVE-2025-54159
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop...
High 7.5

Affected Vendor

Affected Software

Synology Drive Server
Vulnerable Versions:
*

Timeline

Official Publish: March 19th, 2025
Last Modified: March 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact