header-logo
Suggest Exploit
vendor:
AWStats
by:
SecurityFocus
7.5
CVSS
HIGH
Remote Arbitrary Command Execution
78
CWE
Product Name: AWStats
Affected Version From: 5.4
Affected Version To: 6.1
Patch Exists: YES
Related CWE: N/A
CPE: awstats
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005

AWStats Remote Arbitrary Command Execution Vulnerability

AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data. Specifically, the user-specified 'logfile' URI parameter is supplied to the Perl 'open()' routine. This issue is considered distinct from BID 10950 (AWStats Rawlog Plugin Logfile Parameter Input Validation Vulnerability).

Mitigation:

Input validation should be used to ensure that user-supplied data is properly sanitized.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/12572/info

AWStats is reported prone to a remote arbitrary command-execution vulnerability. This issue occurs because the application fails to properly sanitize user-supplied data.

Specifically, the user-specified 'logfile' URI parameter is supplied to the Perl 'open()' routine. This issue is considered distinct from BID 10950 (AWStats Rawlog Plugin Logfile Parameter Input Validation Vulnerability).

AWStats versions 5.4 to 6.1 are reported vulnerable to this issue. 

http://www.example.com/cgi-bin/awstats.pl?update=1&logfile=|/bin/ls|

Navigation

Suggest Exploit

Services By CQR