CVE-2015-2844
HighSummary
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
Risk Assessment
Attackers can exploit this vulnerability to execute remote code, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to update GoAutoDial GoAdmin CE to the latest version to mitigate this vulnerability.
Other vulnerabilities in GoAutoDial GoAdmin CE
See all- CVE-2015-2845High
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before version 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATH_INFO.
- CVE-2015-2843High
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before version 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php and through PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
- CVE-2015-2842High
An unrestricted file upload vulnerability exists in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before version 3.3-1421902800. Attackers can upload a file with an executable extension, allowing remote code execution.
Original NVD description (English source)
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.