Awstats is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user- supplied input. An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system other attacks are also possible. Awstats < 7.0 is vulnerable

• http://awstats.sourceforge.net/
• http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-001.html
• http://www.kb.cert.org/vuls/id/870532
• https://www.securityfocus.com/bid/45123

---

Updated on 2015-03-25