CVE-2015-2844
GoAutoDial GoAdmin CE - Remote Code Execution via cpanel PATH_INFO Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-2844. PoCs published by Chris McCurley.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in GoAutoDial 3.3, including SQL injection for authentication bypass, arbitrary file upload, and command injection leading to remote code execution (RCE). The PoC includes clear examples of malicious payloads and techniques to achieve RCE and privilege escalation.
Description
The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1420434000 allows remote attackers to execute arbitrary commands via the $action portion of the PATH_INFO.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in GoAutoDial 3.3, including SQL injection for authentication bypass, arbitrary file upload, and command injection leading to remote code execution (RCE). The PoC includes clear examples of malicious payloads and techniques to achieve RCE and privilege escalation.