{"uuid": "1b632234-e89e-4ca8-8741-612f3cad1699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2015-2845", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/goautodial_3_rce_command_injection.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Chris McCurley\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection flaw in the login functionality for GoAutoDial version 3.3-1406088000 and below, and attempts to perform command injection. This also attempts to retrieve the admin user details, including the cleartext password stored in the underlying database. Command injection will be performed with root privileges.\\n\\n          This module has been tested successfully on GoAutoDial version 3.3-1406088000.\", \"disclosure_date\": \"2015-04-21\", \"fullname\": \"exploit/linux/http/goautodial_3_rce_command_injection\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"GoAutoDial 3.3 Authentication Bypass / Command Injection\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/linux/http/goautodial_3_rce_command_injection.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/goautodial_3_rce_command_injection\", \"references\": [\"CVE-2015-2843\", \"CVE-2015-2845\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Automatic\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:36.613413Z"}