CVE-2026-44886: Pi.Alert: Web Interface Vulnerable to Unauthenticated Blind SQL Injection

Synopsis

Blind SQL injection in Pi.Alert's web interface allows an unauthenticated remote attacker to extract data from the application's database. The vulnerable endpoint, /pialert/php/server/devices.php, accepts requests without any login check when the action parameter is set to getDevicesTotals, and the scansource parameter is passed directly into a SQL query. Successful exploitation gives an attacker read access to stored data including device records and any other information held in the database. No fix version has been published upstream; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the Pi.Alert web interface.

• AuthenticationNot required

  The getDevicesTotals action accepts requests from unauthenticated users, so no credentials or session token are needed.

• Victim interactionNot required

  The attacker sends crafted requests directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Attack complexity is low: the injection point is straightforward and the exploit is reliable without needing specific timing, memory layout, or environmental conditions.

Blast Radius

• An attacker reads stored device records, network scan results, and any other data persisted in the Pi.Alert database.
• Depending on database contents, stored credentials, API keys, or configuration values held in the application's tables are exposed.
• No integrity or availability impact is indicated by the CVSS vector; data is exposed but not modified or destroyed through this vector alone.