An unauthenticated arbitrary file download vulnerability in EverSync 0.5 poses a critical risk of database theft and credential exposure.

The application fails to restrict access to the files directory, allowing any unauthenticated attacker to perform a GET request to retrieve sensitive files, including the db.sq3 database containing application data and credentials.

Successful exploitation allows an attacker to download the application database without authentication, leading to a complete compromise of stored user credentials and sensitive business information. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that could lead to unauthorized system access and significant data breaches.

Immediate Action: There is no official patch available for this legacy software, so users must immediately restrict access to the files directory via web server configuration or discontinue use of the product.

Proactive Monitoring: Review web server access logs for anomalous GET requests targeting the files directory or attempts to access .sq3 file extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts to the files directory and restrict access to the application via IP whitelisting.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit Database (EDB-ID 45868).

Given the lack of vendor support and the public availability of exploit code, organizations still running EverSync 0.5 are at high risk. It is strongly recommended to migrate away from this software immediately, as it is no longer maintained and cannot be effectively secured against this class of vulnerability.