CVE-2005-0116 AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
HighCVSS 7.5
EPSS 74.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| awstats | <= 6.3 | No fix listed |
| debian/awstats(Debian:12) | < 6.2-1.1 | 6.2-1.1 |
| debian/awstats(Debian:13) | < 6.2-1.1 | 6.2-1.1 |
| debian/awstats(Debian:14) | < 6.2-1.1 | 6.2-1.1 |
References
- Debian Security Tracker CVE-2005-0116 vendor-advisory
- awstats.sourceforge.net patch vendor-advisory
- packetstormsecurity.org
- 13893 patch third-party-advisory vendor-advisory
- 20050117 AWStats Remote Command Execution Vulnerability exploit patch third-party-advisory vendor-advisory
- VU#272296 patch third-party-advisory us-government-resource
- 13002 vdb-entry
- 12298 vdb-entry