Multiple vulnerabilities in GoAutoDial 3.3
Multiple vulnerabilties exist in the GoAutodial 3.3 open source call centre software that will lead to a complete compromise of the underlying database and infrastructure. A simple 'OR '1'='1 in the password field with a username of 'admin' will log you in. (assuming the default administrator user has not been removed). You can also test this by performing the following GET request: https://<ip>/go_login/validate_credentials/admin/' OR '1'='1. This function returns a single entry from the db that contains user information including the username and password. Given that the first 'active' user in the db would most likely be the admin user you can search for active=Y. There is a column in the vicidial_users table that identifies whether a user is active (Y) or not active (N). Given this, you can perform the following to return an admin user's account username and password. https://<ip>/index.php/go_site/go_get_user_info/' or active='Y. This function returns a single entry from the db that contains user information including the username and password. Given that the first 'active' user in the db would most likely be the admin user you can search for active=Y. There is a column in the vicidial_users table that identifies whether a user is active (Y) or not active (N). Given this, you can perform the following to return an admin user's account username and password. https://<ip>/index.php/go_site/go_get_user_info/'<script>alert(1)</script>
