CVE-2015-2843

This Metasploit module exploits a SQL injection vulnerability in GoAutoDial 3.3 for authentication bypass and command injection, leading to remote code execution with root privileges. It also retrieves admin credentials, including cleartext passwords, from the database.

The exploit demonstrates multiple vulnerabilities in GoAutoDial 3.3, including SQL injection for authentication bypass, arbitrary file upload, and command injection leading to remote code execution (RCE). The PoC includes clear examples of malicious payloads and techniques to achieve RCE and privilege escalation.

This Metasploit module exploits a SQL injection flaw in GoAutoDial 3.3's login functionality to bypass authentication and perform command injection with root privileges. It also retrieves admin credentials from the database.