CVE-2015-2842
HighSummary
An unrestricted file upload vulnerability exists in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before version 3.3-1421902800. Attackers can upload a file with an executable extension, allowing remote code execution.
Risk Assessment
This vulnerability poses a significant risk to organizational security, enabling attackers to remotely execute code on the server. This could lead to system compromise and data leakage.
Recommendation
It is recommended to update the system to version 3.3-1421902800 or later and implement mechanisms to restrict file uploads to allowed types only.
Other vulnerabilities in GoAutoDial GoAdmin CE 3.x
See all- CVE-2015-2845High
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
- CVE-2015-2844High
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
- CVE-2015-2843High
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before version 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php and through PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
Original NVD description (English source)
Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in sounds/.