GoAutoDial GoAdmin CE Multiple Security Vulnerabilities
BID:74281
Info
GoAutoDial GoAdmin CE Multiple Security Vulnerabilities
| Bugtraq ID: | 74281 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-2842 CVE-2015-2843 CVE-2015-2844 CVE-2015-2845 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2015 12:00AM |
| Updated: | Apr 21 2015 12:00AM |
| Credit: | Chris McCurley |
| Vulnerable: |
GoAutoDial GoAutoDial 3.3-1406088000 |
| Not Vulnerable: |
GoAutoDial GoAutoDial 3.3-1421902800 |
Discussion
GoAutoDial GoAdmin CE Multiple Security Vulnerabilities
GoAutoDial GoAdmin CE is prone to multiple security vulnerabilities including:
1. Multiple SQL-injection vulnerabilities
2. An arbitrary file upload vulnerability
3. Multiple arbitrary command-injection vulnerabilities
An attacker may leverage these issues to execute arbitrary commands in the context of the vulnerable application, to upload arbitrary files and to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.
GoAutoDial GoAdmin CE is prone to multiple security vulnerabilities including:
1. Multiple SQL-injection vulnerabilities
2. An arbitrary file upload vulnerability
3. Multiple arbitrary command-injection vulnerabilities
An attacker may leverage these issues to execute arbitrary commands in the context of the vulnerable application, to upload arbitrary files and to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.
Exploit / POC
GoAutoDial GoAdmin CE Multiple Security Vulnerabilities
Attackers can exploit these issues using a browser. To exploit a cross-site scripting and cross-site request-forgery issues, an attacker must entice an unsuspecting victim into following a URI.
Attackers can exploit these issues using a browser. To exploit a cross-site scripting and cross-site request-forgery issues, an attacker must entice an unsuspecting victim into following a URI.