CVE-2015-2845: GoAutoDial GoAdmin CE cpanel function OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with a 10.0 CVSS score, public exploit code and very high EPSS probability makes this an urgent patch-or-isolate case.

What it is

The cpanel function in go_site.php in GoAutoDial GoAdmin CE before 3.3-1421902800 passes the $type portion of PATH_INFO into a system command without sanitization, allowing OS command injection. Because the endpoint is network-reachable and unauthenticated, this is a full compromise of the host running GoAdmin CE.

Impact

An attacker can execute arbitrary commands with the web server's privileges, leading to complete loss of confidentiality, integrity and availability of the application and underlying host. CVSS 2.0 scores it 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C).

Attack surface

Reached over the network via HTTP requests to go_site.php, with the malicious payload placed in the $type segment of PATH_INFO. The CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Exploit code is publicly available (Exploit-DB 36807 tagged Exploit, plus a Packet Storm advisory), and EPSS is 0.71517 (99.4th percentile), indicating high likelihood of exploitation. It is not listed in CISA KEV.

What to do

• Upgrade GoAdmin CE to 3.3-1421902800 or later, per the vendor advisory at goautodial.org/news/21.
• If upgrade is not possible, restrict network access to go_site.php and the GoAdmin CE admin interface to trusted management networks only.
• Deploy a WAF or reverse-proxy rule that rejects command metacharacters in PATH_INFO for go_site.php.
• Run the GoAdmin CE web service under a low-privilege account with no shell access and no write access to application code.
• Audit the host for signs of prior compromise before and after remediation.

Detection

• Inspect web server and proxy logs for go_site.php requests whose PATH_INFO contains shell metacharacters such as ;, |, &&, $(), or backticks.
• Monitor for unexpected child processes spawned by the web server user (for example sh, bash, curl, wget, nc).
• Alert on outbound connections or file writes originating from the GoAdmin CE web process.
• Review the host for webshells or new files in web-accessible directories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.