CVE-2015-2843
HighSummary
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before version 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php and through PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
Risk Assessment
An attacker can gain access to sensitive data in the database, potentially leading to a loss of confidentiality and integrity of the organization's data.
Recommendation
It is recommended to update GoAutoDial GoAdmin CE to the latest version and implement appropriate safeguards against SQL injection.
Other vulnerabilities in GoAutoDial GoAdmin CE
See all- CVE-2015-2845High
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
- CVE-2015-2844High
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
- CVE-2015-2842High
An unrestricted file upload vulnerability exists in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before version 3.3-1421902800. Attackers can upload a file with an executable extension, allowing remote code execution.
Original NVD description (English source)
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.