CyberRota Analysis
AI-GeneratedWallos versions prior to 4.9.4 are vulnerable due to an unauthenticated endpoint that allows attackers to execute database schema migrations via HTTP, potentially compromising the integrity of the live SQLite database. This high-severity vulnerability poses a significant risk to any instance of Wallos that has not been updated, as it can lead to unauthorized data manipulation. Organizations using Wallos should prioritize upgrading to version 4.9.4 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.