Sql injection

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 userpass parameter in gologin.php or the PATHINFO to 3 gologin/validatecredentials/admin/ or 4 index.php/gosite/gogetuserinfo/...

Command injection

The cpanel function in gosite.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATHINFO...

CVE-2015-2844

The cpanel function in gosite.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATHINFO...

CVE-2015-2844

CVE-2015-2844 affects GoAutoDial GoAdmin CE prior to 3.3-1420434000. The cpanel function in go_site.php processes the PATH_INFO action segment, and unsafely passes it to command execution, enabling remote attackers to run arbitrary commands. Impact: remote code execution with complete system comp...

CVE-2015-2842

Unrestricted file upload vulnerability in goaudiostore.php in the audiostore Voice Files upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct reque...

CVE-2015-2843

GoAutoDial GoAdmin CE is vulnerable to SQL injection in go_login.php (parameters user_name, user_pass) and via PATH_INFO in go_login/validate_credentials/admin/ or index.php/go_site/go_get_user_info/. Affected versions are GoAutoDial GoAdmin CE before 3.3-1421902800. The root cause is inadequate ...

CVE-2015-2842

GoAutoDial GoAdmin CE 3.x prior to 3.3-1421902800 is affected by an unrestricted file upload in the audiostore.php go_audiostore upload function. The vulnerability allows remote attackers to upload a file with an executable extension (despite a .wav check) and then access it via a direct URL unde...

CVE-2015-2843

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 userpass parameter in gologin.php or the PATHINFO to 3 gologin/validatecredentials/admin/ or 4 index.php/gosite/gogetuserinfo/...

CVE-2015-2842: Undefined Security Weakness

Unrestricted file upload vulnerability in goaudiostore.php in the audiostore Voice Files upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct reque...

GoAutoDial 3.3 multiple vulnerabilities

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

CVE-2015-2843: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the 1 username or 2 userpass parameter in gologin.php or the PATHINFO to 3 gologin/validatecredentials/admin/ or 4 index.php/gosite/gogetuserinfo/...

CVE-2015-2844: Improper Neutralization of Special Elements used in an OS Command

The cpanel function in gosite.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATHINFO...

CVE-2015-2845: Improper Neutralization of Special Elements used in an OS Command

The cpanel function in gosite.php in GoAutoDial GoAdmin CE before 3.3-1421902800 allows remote attackers to execute arbitrary commands via the $type portion of the PATHINFO...

GoAutoDial SQL Injection / Command Execution / File Upload

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection

GoAutoDial CE 3.3-1406088000 - Authentication Bypass Arbitrary File Upload Command Injection Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory:...

GoAutoDial SQL Injection / Command Execution / File Upload Vulnerabilities

GoAutoDial versions 3.3-1406088000 and below suffer from arbitrary file upload, command injection, and remote SQL injection vulnerabilities. Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

GoAutoDial 3.3 Authentication Bypass / Command Injection

This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command...

GoAutoDial CE 2.0 - Shell Upload Vulnerability

Exploit for php platform in category web applications Title : GoAutoDial CE 2.0 Shell Upload Date : 28/02/2015 Author : R-73eN Software : GoAutoDial CE 2.0 Tested : On Linux vicisrv.loc 2.6.18-238.9.1.el5.goPAE 1 GoAutoDial CE 2.0 import socket import sys banner = "\n\n" banner +=" \n" banner +="...

GoAutoDial CE 2.0 - Arbitrary File Upload

GoAutoDial CE 2.0 - Arbitrary File Upload Title : GoAutoDial CE 2.0 Shell Upload Date : 28/02/2015 Author : R-73eN Software : GoAutoDial CE 2.0 Tested : On Linux vicisrv.loc 2.6.18-238.9.1.el5.goPAE 1 GoAutoDial CE 2.0 import socket import sys banner = "\n\n" banner +=" \n" banner +=" | | / | / |...