Goal Reached Thanks to every supporter โ€” we hit 100%!

Goal: 1000 CNY ยท Raised: 1336 CNY

100%

CVE-2015-2845 โ€” AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

๐Ÿšจ **Essence**: Remote Command Injection in GoAutoDial GoAdmin CE. ๐Ÿ’ฅ **Consequences**: Attackers can execute arbitrary OS commands on the server via the `go_site.php` script. This leads to full system compromise.

Q2Root Cause? (CWE/Flaw)

๐Ÿ›ก๏ธ **Root Cause**: Improper input validation in the `cpanel` function within `go_site.php`.โ€ฆ

Q3Who is affected? (Versions/Components)

๐Ÿ“ฆ **Affected Product**: GoAutoDial GoAdmin CE (Open-source Call Center Software on CentOS). ๐Ÿ“‰ **Versions**: All versions **prior to** 3.3-1420434000. โš ๏ธ **Component**: Specifically the `go_site.php` script.

Q4What can hackers do? (Privileges/Data)

๐Ÿ’€ **Capabilities**: Remote attackers gain the ability to run **arbitrary commands** with the privileges of the web server process.โ€ฆ

Q5Is exploitation threshold high? (Auth/Config)

โšก **Threshold**: **LOW**. ๐ŸŒ **Auth**: No authentication required for remote exploitation via `PATH_INFO`.โ€ฆ

Q6Is there a public Exp? (PoC/Wild Exploitation)

๐Ÿ”“ **Public Exploits**: **YES**. ๐Ÿ“œ **References**: Exploit-DB IDs **42296** and **36807** are available. ๐ŸŒ **Wild Exploitation**: High risk due to available PoCs and mailing list disclosures (Bugtraq).

Q7How to self-check? (Features/Scanning)

๐Ÿ” **Self-Check**: Scan for the presence of `go_site.php` in the web root. ๐Ÿงช **Test**: Attempt to inject shell commands via the `PATH_INFO` parameter targeting the `cpanel` function.โ€ฆ

Q8Is it fixed officially? (Patch/Mitigation)

๐Ÿฉน **Official Fix**: **YES**. ๐Ÿ“… **Patch Date**: Disclosed around May 2015. โœ… **Solution**: Upgrade to version **3.3-1420434000** or later. ๐Ÿ“ **Source**: Vendor confirmation via goautodial.org news.

Q9What if no patch? (Workaround)

๐Ÿšง **Workaround**: If patching is impossible, restrict web server access to `go_site.php` via firewall rules. ๐Ÿ›‘ **Mitigation**: Disable `PATH_INFO` processing if supported by the web server configuration.โ€ฆ

Q10Is it urgent? (Priority Suggestion)

๐Ÿ”ฅ **Urgency**: **CRITICAL**. ๐Ÿšจ **Priority**: **P1**. โš ๏ธ **Reason**: Unauthenticated RCE with public exploits. Immediate patching or isolation is required to prevent immediate compromise.