PT-2021-23761 · Unknown · Goautodial

Scott Tolley · Published 2021-12-07 · Updated 2021-12-09 · CVE-2021-43176

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GOautodial versions prior to commit 3c3a979

Description The issue allows an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. This is possible because the action parameter is not sanitized, permitting the execution of arbitrary PHP files.

Recommendations For versions prior to commit 3c3a979, update to a version that includes the commit 3c3a979 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive PHP files to minimize the risk of exploitation.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2021-43176

Affected Products

Goautodial

References · 4

• 🔥 https://synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2021-43176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43176 · Security Note
• https://t.me/cibsecurity/33487 · Telegram Post