GOautodial API flaw lets low-privilege agents run OS commands on call-center servers

A high-severity OS command injection vulnerability (CVE pending, CVSS 8.8) has been discovered in GOautodial's goAPIv2 REST API, a widely used open-source call-center platform. The flaw exists because the goPhone request parameter is sanitized using a SQL escape function, which neutralizes SQL metacharacters but leaves shell metacharacters like $(...) intact, allowing arbitrary command execution when the value is passed to PHP's exec(). Any authenticated agent — the lowest trust level in the system — can exploit the goLogoutUser endpoint without special permissions, since it requires no active campaign. On real deployments, the injected command runs through a sudo wrapper, making the practical impact potentially greater than the already-High CVSS score suggests. The vulnerability was discovered and reported by security researcher Santosh Kumar Puppala and has been patched in the goAPIv2 master branch at commit 0ab2584.