Description
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
AWStats Totals multisort Remote Command Execution
exploit/unix/webapp/awstatstotals_multisort
Exploit-DB 2
- AWStats Totals 1.14 multisort - Remote Command Execution (Metasploit) EDB-17324 · webapps · May 25, 2011 · verified
- AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution EDB-6368 · webapps · Sep 5, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 6368 exploit
- 17324 exploit
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
- http://www.telartis.nl/xcms/awstats/
- awstatstotals-multisort-command-execution(44712) vdb-entry
- 4218 third-party-advisory
- ADV-2008-2442 vdb-entry
- 31630 third-party-advisory
- 8259 third-party-advisory
- 30856 vdb-entry
- 20080826 Multiple Vulnerabilities in AWStats Totals mailing-list