Synology DiskStation Manager Auth API SQL Injection Vulnerability

An SQL injection vulnerability has been found in the Auth API in Synology DiskStation Manager (DSM).

Affected versions are:

• DSM before 7.2.1-69057-13
• DSM before 7.2.2-72806-10
• DSM before 7.3.2-86009-5
• DSM before 7.4.1-90080-1

Remote attackers can exploit this issue to read or write arbitrary files and conduct denial-of-service attacks.