CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

Link	Resource
http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
http://www.telartis.nl/xcms/awstats/	Patch
http://secunia.com/advisories/31630	Vendor Advisory
http://securityreason.com/securityalert/4218
http://www.securityfocus.com/bid/30856
http://www.vupen.com/english/advisories/2008/2442
http://www.exploit-db.com/exploits/17324
http://securityreason.com/securityalert/8259
https://exchange.xforce.ibmcloud.com/vulnerabilities/44712
https://www.exploit-db.com/exploits/6368
http://www.securityfocus.com/archive/1/495770/100/0/threaded

Configuration 1

cpe:2.3:a:telartis_bv:awstats_totals:1.11:*:*:*:*:*:*:* cpe:2.3:a:telartis_bv:awstats_totals:1.1:*:*:*:*:*:*:* cpe:2.3:a:telartis_bv:awstats_totals:1.13:*:*:*:*:*:*:* cpe:2.3:a:telartis_bv:awstats_totals:1.14:*:*:*:*:*:*:* cpe:2.3:a:telartis_bv:awstats_totals:1.0:*:*:*:*:*:*:*

---

Published : 2008-09-04 06:41

Updated : 2018-10-11 08:50

---

NVD link : CVE-2008-3922

Mitre link : CVE-2008-3922

No products.

CWE-94