Vulnerability Details : CVE-2015-2842
Potential exploit
Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in sounds/.
Vulnerability category: Execute code
Products affected by CVE-2015-2842
- cpe:2.3:a:goautodial:goadmin_ce:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:goautodial:goadmin_ce:3.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-2842
6.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 94 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-2842
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
References for CVE-2015-2842
-
http://www.securityfocus.com/archive/1/535319/100/1100/threaded
SecurityFocus
-
http://www.securityfocus.com/bid/74281
GoAutoDial GoAdmin CE Multiple Security Vulnerabilities
-
https://www.exploit-db.com/exploits/36807/
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command InjectionExploit
-
http://goautodial.org/news/21
GoAdmin CE Security Vulnerability - GOautodial Omni-channel Contact Center Suite - GOautodial Open Source Omni-channel Contact Center Suite (predictive dialer + inbound IVR & ACD + non-voice)Vendor Advisory
-
http://packetstormsecurity.com/files/131543/GoAutoDial-SQL-Injection-Command-Execution-File-Upload.html
GoAutoDial SQL Injection / Command Execution / File Upload ≈ Packet Storm
Jump to