CVE-2005-0116

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• AWStats 6.1 < 6.2 - 'configdir' Remote Command Execution (Metasploit)2009-12-26 · webapps · cgi · Verified
• AWStats 6.2 < 6.1 - configdir Command Injection (Metasploit)2005-01-15 · webapps · cgi · Verified
• AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution2005-01-25 · webapps · cgi · Verified
• AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution2005-01-25 · webapps · cgi · Verified

Impact

AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://awstats.sourceforge.net/docs/awstats_changelog.txt
• http://packetstormsecurity.org/0501-exploits/AWStatsVulnAnalysis.pdf
• http://secunia.com/advisories/13893/
• http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false
• http://www.kb.cert.org/vuls/id/272296
• http://www.osvdb.org/13002
• http://www.securityfocus.com/bid/12298
• http://awstats.sourceforge.net/docs/awstats_changelog.txt
• http://packetstormsecurity.org/0501-exploits/AWStatsVulnAnalysis.pdf
• http://secunia.com/advisories/13893/
• http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false
• http://www.kb.cert.org/vuls/id/272296
• http://www.osvdb.org/13002
• http://www.securityfocus.com/bid/12298