An authentication bypass vulnerability in the Wallos subscription tracker allows unauthenticated attackers to overwrite the database, posing a high risk to data integrity.

This is an improper authentication vulnerability (CWE-287) located in the endpoints/db/import.php file. An unauthenticated attacker can replace the entire database if the user table row count is zero, which typically occurs in fresh or unconfigured installations.

The ability to overwrite the database could result in complete data loss or the injection of malicious administrative accounts, leading to unauthorized access and loss of service. With a CVSS score of 8.2, this vulnerability represents a significant risk to the availability and integrity of the Wallos platform.

Immediate Action: Update the Wallos installation to version 4.9.4 or later immediately.

Proactive Monitoring: Review web server access logs for unusual requests directed at the endpoints/db/import.php file.

Compensating Controls: Ensure the Wallos instance is not exposed to the public internet and restrict access to the application via a VPN or IP allow-listing.

Public Exploit Available: No confirmed public exploit available.

Given the high CVSS score and the critical impact of database modification, administrators should prioritize updating to version 4.9.4. Failure to apply this patch leaves the application susceptible to unauthorized database manipulation, potentially leading to total system compromise.