CVE-2015-2843
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 37.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 37.93% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- goautodial/goadmin ce
- Source
- cve@mitre.org
References
- http://goautodial.org/news/21Vendor Advisory
- http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
- http://www.securityfocus.com/archive/1/535319/100/1100/threaded
- http://www.securityfocus.com/bid/74281
- https://www.exploit-db.com/exploits/36807/Exploit
- https://www.exploit-db.com/exploits/42296/
- http://goautodial.org/news/21Vendor Advisory
- http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
- http://www.securityfocus.com/archive/1/535319/100/1100/threaded
- http://www.securityfocus.com/bid/74281
- https://www.exploit-db.com/exploits/36807/Exploit
- https://www.exploit-db.com/exploits/42296/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.