RSS   Vulnerabilities for 'Goautodial'   RSS

2021-12-07
 
CVE-2021-43175

CWE-287
 
 
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 exposes an API router that accepts a username, password, and action that routes to other PHP files that implement the various API functions. Vulnerable versions of GOautodial validate the username and password incorrectly, allowing the caller to specify any values for these parameters and successfully authenticate. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

 
 
CVE-2021-43176

CWE-22
 
 
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied �??action�?� parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

 

 >>> Vendor: Goautodial 3 Products
Goadmin ce
Goautodial
Goautodial api

Copyright 2024, cxsecurity.com

 

Back to Top