| Package | Affected versions | Patched versions |
|---|---|---|
| wallos | ≤ 2.38.2 |
Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by uploading a ZIP file. The contents of the ZIP file are extracted on the server. This functionality enables an unauthenticated attacker to upload malicious files to the server. Once a web shell is installed, the attacker gains the ability to execute arbitrary commands.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free