Jeroen

The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the `timeline` parameter in the "content timeline class.php" file, or the `id` parameter to the "pages/content timeline edit.php" or "pages/content timeline index.php" pages.

The issue affects the Seagate BlackArmor NAS 220 devices, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forgery (CSRF) vulnerabilities for various actions, including adding user accounts via a crafted request to "admin/access control user add.php", modifying or deleting user accounts, performing a factory reset, rebooting the device, or adding, modifying, or deleting shares and volumes.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the `fullname` parameter to "admin/access control user edit.php" and the `workname` parameter to "admin/network workgroup domain.php" are vulnerable.

The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for various requests, including performing a factory reset via a request to "goform/system/factory", disabling advanced options via a request to "goform/advanced/options", removing ip-filters via the `IpFilterAddressDelete1` parameter to "goform/advanced/ip-filters", or removing firewall settings via the `cbFirewall` parameter to "goform/advanced/firewall".

The issue allows remote attackers to obtain the session ID via an HTTP Referer field and possibly other vectors, because the Next action includes the SID in the URL even when session.use only cookies is configured.