CVE-2015-2843

Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

37.93% chance of exploitation in the next 30 days, 98th percentile

Published

2015-05-12

Updated

2024-08-06

Proof-of-concept exploits (2)

• CodeXTF2/goautodial-rce-exploit4★ · 2022-03-09
• TarunYenni/GoAutoDial-CE-3.3-Exploit-Authentication-Bypass-Command-Injection2★ · 2022-08-24

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/goautodial_3_rce_comm…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/42296
• https://www.exploit-db.com/exploits/36807

References

• CVE Record
• NVD entry

Related

• CVE-2015-2844
• CVE-2015-2845
• CVE-2015-2842
• CVE-2015-2841
• CVE-2015-2838
• CVE-2015-2857