#Awstats vulnerability software
#Awstats vulnerability code
#Awstats vulnerability password

Just as a tip, it's generally not a bad idea to keep awstats (and other scripts like awstats) protected behind some password authentication using htpasswd or equivalent. htaccess files that only allow access from my own IP (and the proxy server at work). The vulnerability exists as cgi-bin/config accepts an absolute pathname, even though it was. It uses a partial information file to be able to process large log files. This log analyzer works as a CGI or from command line and shows you all possible information your log contains, in few graphical web pages.

#Awstats vulnerability code

I keep a lot of things like this (webalizer, server-status, munin) protected by. awstats is vulnerable to remote code execution. AWStats is a free powerful and featureful tool that generates advanced web, streaming, ftp or mail server statistics, graphically. |_Output for 'uname -a':Linux 2.4.Description Just as a tip, it's generally not a bad idea to keep awstats (and other scripts like awstats) protected behind some password authentication using htpasswd or equivalent. Nmap -sV -script http-awstatstotals-exec.nse There is no known workaround at this time. Please review the referenced CVE identifiers for details. Please review the CVE identifiers referenced below for details. Multiple vulnerabilities have been discovered in AWStats. Example Usage nmap -sV -script http-awstatstotals-exec.nse -script-args 'http-awstatstotals-exec.cmd='uname -a', http-awstatstotals-exec.uri=/awstats/index.php' AWStats is an advanced log file analyzer and statistics generator. We also display any CVSS information provided within the CVE List from the CNA. IP addresses with this tag have been observed attempting to exploit CVE-2005-0116, a remote code execution vulnerability in the configdir function in. AWStats is vulnerable to cross-site scripting, caused by improper validation of user-supplied. NVD Analysts use publicly available information to associate vector strings and CVSS scores. See the documentation for the smbauth library. Follow the X-Force Vulnerability Report for CVE-2008-5080. Example Run As an example we will look at a vulnerability in Awstats, a popular open source Web statistics and log parsing utility.Awstats suffered from a.

#Awstats vulnerability software

smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername A remote command execution vulnerability exists in the script used in the AWStats software package. See the documentation for the http library. Open redirect vulnerability in in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites. http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, uncated-ok, eragent

See the documentation for the slaxml library. eragent - User Agent to use in GET request bug Other useful args when running this script: Default: whoami http-awstatstotals-exec.outfile Default: /index.php http-awstatstotals-exec.cmdĬommand to execute. Script Arguments http-awstatstotals-exec.uriĪwstats Totals URI including path. By specifying a nonexistent config file to the config parameter in awstats. The installed version is affected by a path disclosure vulnerability. AWStats could be installed as a standalone package or could be bundled or shipped with a third-party software such as WebGUI Runtime Environment. The script queries the web server with the command payload encoded using PHP's AWStats is installed on the remote system. Hole 2: Version 6.4 and 6.5 (vulnerable to remote command via the migrate parameter, not vulnerable to Lupper Worm): When AWStats version is 6.4 or 6. Direct code injection vulnerability in in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter.

This vulnerability can be exploited through the GET variable sort. When AWStats version is 6.5 or lower and is used to build static pages: If you use AWStats to build static pages, you are completely safe, whatever is the version of AWStats you use. Script Arguments Example Usage Script Output Script http-awstatstotals-execĮxploits a remote code execution vulnerability in Awstats Totals 1.0 up to 1.14Īnd possibly other products based on it (CVE: 2008-3922).