CVE-2015-2843

GoAutoDial GoAdmin CE is vulnerable to SQL injection in go_login.php (parameters user_name, user_pass) and via PATH_INFO in go_login/validate_credentials/admin/ or index.php/go_site/go_get_user_info/. Affected versions are GoAutoDial GoAdmin CE before 3.3-1421902800. The root cause is inadequate ...

CVE-2015-2845

CVE-2015-2845 affects GoAutoDial GoAdmin CE prior to 3.3-1421902800. The vulnerability arises in the cpanel function in go_site.php: an attacker can craft PATH_INFO via the $type parameter to execute arbitrary commands remotely. This is a command injection vulnerability with high severity (remote...

CVE-2015-2844

CVE-2015-2844 affects GoAutoDial GoAdmin CE prior to 3.3-1420434000. The cpanel function in go_site.php processes the PATH_INFO action segment, and unsafely passes it to command execution, enabling remote attackers to run arbitrary commands. Impact: remote code execution with complete system comp...

CVE-2015-2842

GoAutoDial GoAdmin CE 3.x prior to 3.3-1421902800 is affected by an unrestricted file upload in the audiostore.php go_audiostore upload function. The vulnerability allows remote attackers to upload a file with an executable extension (despite a .wav check) and then access it via a direct URL unde...