Threats tagged 'ghsa-g756-f8g3-qffc'

Ground Station prior to version 0.6.0 has a critical vulnerability in its Socket.IO server's database_backup event handler that allows unauthenticated network peers to destroy or replace the entire SQLite database. Due to disabled authentication enforcement and a wildcard CORS policy, attackers can connect without credentials and execute arbitrary SQL commands to wipe or manipulate satellite data and configurations.