OSVDB ID: 25284 Title: AWStats migrate Variable Arbitrary Command Execution |
Info |
|
|
Dates |
||||
|
|
Description |
AWStats contains a flaw that may allow a malicious user to execute arbitrary commands via the "|" pipe character. The issue is triggered due to improper sanitization to the 'migrate' variable before being used in an "open()" call. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Integrity Solution: Upgrade, Third-Party Solution Exploit: Exploit Public, Exploit Commercial Disclosure: OSVDB Verified, Vendor Verified |
Solution |
Upgrade to version 6.6 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
Credit |
|
enyo.de -