CVE-2006-2237

EXPLOITED

AWStats <6.5 - RCE

Title source: llm

Description

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

Exploits (4)

exploitdb WORKING POC VERIFIED

by patrick · rubywebappscgi

https://www.exploit-db.com/exploits/9909

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Metasploit · rubywebappscgi

https://www.exploit-db.com/exploits/16886

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by aushack · rubypocunix

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/awstats_migrate_exec.rb

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by redsand · pythonwebappscgi

https://www.exploit-db.com/exploits/1755

View Code ZIP pw:eip

References (16)

[Product] http://awstats.sourceforge.net/awstats_security_news.php

[Patch, Vendor Advisory] http://secunia.com/advisories/19969

[Patch] http://www.osvdb.org/25284

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/26287

[Vendor Advisory] https://usn.ubuntu.com/285-1/

[Various Sources] http://www.osreviews.net/reviews/comm/awstats

[Various Sources] http://www.vuxml.org/freebsd/2df297a2-dc74-11da-a22b-000c6ec775d9.html

[Vendor Advisory] http://www.novell.com/linux/security/advisories/2006_33_awstats.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/17844

[Third Party Advisory] http://www.debian.org/security/2006/dsa-1058

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200606-06.xml

[Third Party Advisory] http://secunia.com/advisories/20170

[Third Party Advisory] http://secunia.com/advisories/20186

[Third Party Advisory] http://secunia.com/advisories/20496

[Third Party Advisory] http://secunia.com/advisories/20710

[Third Party Advisory] http://www.vupen.com/english/advisories/2006/1678

Scores

EPSS 0.9060

EPSS Percentile 99.6%

Exploitation Intel

VulnCheck KEV 2020-12-01

Classification

Status draft

Affected Products (2)

awstats/awstats

Timeline

Published May 08, 2006

Tracked Since Feb 18, 2026