CVE-2008-3922
EXPLOITEDAWStats Totals 1.0-1.14 - Remote Code Execution via Sort Parameter
Title source: llmExploitation Summary
CVE-2008-3922 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including Metasploit, Ricardo Almeida, aushack, including a Metasploit module exploits/unix/webapp/awstatstotals_multisort.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in AWStats Totals PHP script (CVE-2008-3922) by manipulating the 'sort' parameter to execute arbitrary commands. The exploit sends a crafted HTTP GET request with a payload encoded in the URI, leveraging the 'passthru' function to achieve remote code execution.
Description
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in AWStats Totals PHP script (CVE-2008-3922) by manipulating the 'sort' parameter to execute arbitrary commands. The exploit sends a crafted HTTP GET request with a payload encoded in the URI, leveraging the 'passthru' function to achieve remote code execution.
This PHP script exploits CVE-2008-3922 in AWStats Totals by injecting arbitrary commands via the 'sort' parameter, achieving remote code execution. It handles both magic_quotes on and off scenarios by encoding commands differently.
This Metasploit module exploits a command injection vulnerability in AWStats Totals (v1.0 - v1.14) via the 'sort' parameter, allowing arbitrary command execution. The exploit uses URI encoding to bypass input validation and executes the payload through the 'passthru' function.