CVE-2015-2845 — AI Deep Analysis Summary

🚨 **Essence**: Remote Command Injection in GoAutoDial GoAdmin CE. 💥 **Consequences**: Attackers can execute arbitrary OS commands on the server via the `go_site.php` script. This leads to full system compromise.

🛡️ **Root Cause**: Improper input validation in the `cpanel` function within `go_site.php`.…

📦 **Affected Product**: GoAutoDial GoAdmin CE (Open-source Call Center Software on CentOS). 📉 **Versions**: All versions **prior to** 3.3-1420434000. ⚠️ **Component**: Specifically the `go_site.php` script.

💀 **Capabilities**: Remote attackers gain the ability to run **arbitrary commands** with the privileges of the web server process.…

⚡ **Threshold**: **LOW**. 🌐 **Auth**: No authentication required for remote exploitation via `PATH_INFO`.…

🔓 **Public Exploits**: **YES**. 📜 **References**: Exploit-DB IDs **42296** and **36807** are available. 🌍 **Wild Exploitation**: High risk due to available PoCs and mailing list disclosures (Bugtraq).

🔍 **Self-Check**: Scan for the presence of `go_site.php` in the web root. 🧪 **Test**: Attempt to inject shell commands via the `PATH_INFO` parameter targeting the `cpanel` function.…

🩹 **Official Fix**: **YES**. 📅 **Patch Date**: Disclosed around May 2015. ✅ **Solution**: Upgrade to version **3.3-1420434000** or later. 📝 **Source**: Vendor confirmation via goautodial.org news.

🚧 **Workaround**: If patching is impossible, restrict web server access to `go_site.php` via firewall rules. 🛑 **Mitigation**: Disable `PATH_INFO` processing if supported by the web server configuration.…

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P1**. ⚠️ **Reason**: Unauthenticated RCE with public exploits. Immediate patching or isolation is required to prevent immediate compromise.