Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS Information
N/A
Vulnerability Type
相对路径遍历
Vulnerability Title
GOautodial 路径遍历漏洞
Vulnerability Description
GOautodial是下一代开源全渠道联络中心套件。 GOautodial存在安全漏洞，该漏洞源于软件采用用户提供的action参数并附件php文件扩展名来定位和加载正确的PHP文件，但没有过滤和转义用户的输入，攻击者可以利用该漏洞执行任何php源文件。
CVSS Information
N/A
Vulnerability Type
N/A