CVE-2021-43176

Name of the Vulnerable Software and Affected Versions GOautodial versions prior to commit 3c3a979

Description The issue allows an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. This is possible because the action parameter is not sanitized, permitting the execution of arbitrary PHP files.

Recommendations For versions prior to commit 3c3a979, update to a version that includes the commit 3c3a979 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive PHP files to minimize the risk of exploitation.