CVE-2005-0116

EXPLOITED

Awstats < 6.3 - Improper Input Validation

Title source: rule

Description

AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.

Exploits (5)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappscgi
https://www.exploit-db.com/exploits/16905
exploitdb WORKING POC VERIFIED
by THUNDER · cwebappscgi
https://www.exploit-db.com/exploits/772
exploitdb WORKING POC VERIFIED
by GHC · perlwebappscgi
https://www.exploit-db.com/exploits/773
exploitdb WORKING POC VERIFIED
by Matteo Cantoni · rubywebappscgi
https://www.exploit-db.com/exploits/9912
metasploit WORKING POC EXCELLENT
rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/awstats_configdir_exec.rb

Scores

EPSS 0.9198
EPSS Percentile 99.7%

Details

VulnCheck KEV 2020-12-01
CWE
CWE-20
Status published
Products (1)
awstats/awstats < 6.3
Published Jan 18, 2005
Tracked Since Feb 18, 2026