CVE-2008-3922 awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically...
HighCVSS 9.3
EPSS 53.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telartis bv awstats totals | = 1.0 | No fix listed |
| telartis bv awstats totals | = 1.1 | No fix listed |
| telartis bv awstats totals | = 1.11 | No fix listed |
| telartis bv awstats totals | = 1.13 | No fix listed |
| telartis bv awstats totals | = 1.14 | No fix listed |
References
- 31630 third-party-advisory vendor-advisory
- 4218 third-party-advisory
- 8259 third-party-advisory
- userwww.service.emory.edu
- 17324 exploit
- 20080826 Multiple Vulnerabilities in AWStats Totals mailing-list
- 30856 vdb-entry
- www.telartis.nl patch
- ADV-2008-2442 vdb-entry
- awstatstotals-multisort-command-execution(44712) vdb-entry
- 6368 exploit