Synology Diskstation privilege escalation and repair

Brief description: a security problem exists in the Synology Diskstation implementation, which can lead to a User Privilege Escalation to root.
Required for obtaining permissions: Install the photo plug-in or other php programs with Vulnerabilities

By reading apache configuration, we can find that Alias/photosrc points to the user's image directory. If the phpmyadmin plug-in is installed and the root password is not set, you can directly use mysql's into outfile to write webshell to the image directory. in addition, it is also feasible to use ftp or background management to upload shell to the image directory. then, you can obtain webshell through http: // xxxxxxxxx/photosrc/directory name/shell file name.

After obtaining webshell, you can bounce a shell to the attacker's computer. then there is a file in the/tmp directory that caches the smb password. Unfortunately, this file is readable by any user. if the Administrator has logged on to the NAS using smb, he can get the hash cracking as root.
Proof of vulnerability:

Solution: Set the cache file to be unreadable by www users