Executive brief
Pi.Alert, a network security tool used to monitor Wi-Fi and LAN intruders, contains a security flaw that allows unauthorized individuals to access its internal database. By sending a specially crafted web request, an attacker can bypass login requirements and steal sensitive information stored within the application. This could lead to the exposure of network device lists, monitoring logs, and other configuration data.
Technical details
An unauthenticated blind SQL injection vulnerability exists in Pi.Alert's web interface within the `/pialert/php/server/devices.php` component. The application fails to properly sanitize the `scansource` URL parameter when the `action` parameter is set to `getDevicesTotals`. Furthermore, the code contains an explicit authentication bypass for this specific action, allowing requests even when password protection is enabled. An attacker can exploit this by injecting SQL commands into the `scansource` parameter to exfiltrate data from the SQLite database. The issue was addressed in the 2026-05-07 update by implementing better input handling and access controls.
Affected products
- leiweibau Pi.Alert >=2024-06-29 <2026-05-07
Timeline
- 2024-06-29: other: Vulnerability introduced
- 2026-05-07: patched: Fixed in version released on this date
- 2026-05-27: advisory: CVE published