CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

CVE-2021-43176

creationtimestamp| type| source ---|---|--- 2021-12-07 20:22:07+00:00| seen| https://t.me/cibsecurity/33487...

CVE-2021-43176

The CVE-2021-43176 entry describes a GOautodial API vulnerability: prior to commit 3c3a979 (Oct 13, 2021), the API accepts a user-supplied action parameter and appends .php to locate/load a PHP file, without sanitizing the action input. This allows an attacker to execute any PHP source file prese...