high7.5Public exploit code
CVE-2010-4367
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configura…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- AWStats 6.x - Apache Tomcat Configuration File Arbitrary Command Execution2010-11-30 · webapps · cgi · Verified
Impact
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Awstats | Awstats | through 6.95 Versions 1.0, 2.1., 2.2.3, 2.2.4, 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://awstats.sourceforge.net/docs/awstats_changelog.txt
- http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:033
- http://awstats.sourceforge.net/docs/awstats_changelog.txt
- http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:033