CVEvulnerability
CVE-2008-3922
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-09-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Affected configurations
• telartis bv awstats totals 1.0
• telartis bv awstats totals 1.1
• telartis bv awstats totals 1.11
• telartis bv awstats totals 1.13
• telartis bv awstats totals 1.14
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://secunia.com/advisories/31630 Vendor Advisory
- http://securityreason.com/securityalert/4218 securityreason.com
- http://securityreason.com/securityalert/8259 securityreason.com
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt userwww.service.emory.edu
- http://www.exploit-db.com/exploits/17324 www.exploit-db.com
- http://www.securityfocus.com/archive/1/495770/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/30856 www.securityfocus.com
- http://www.telartis.nl/xcms/awstats/ Patch
- http://www.vupen.com/english/advisories/2008/2442 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44712 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6368 www.exploit-db.com
- http://secunia.com/advisories/31630 Vendor Advisory
- http://securityreason.com/securityalert/4218 securityreason.com
- http://securityreason.com/securityalert/8259 securityreason.com
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt userwww.service.emory.edu
- http://www.exploit-db.com/exploits/17324 www.exploit-db.com
- http://www.securityfocus.com/archive/1/495770/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/30856 www.securityfocus.com
- http://www.telartis.nl/xcms/awstats/ Patch
- http://www.vupen.com/english/advisories/2008/2442 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44712 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/6368 www.exploit-db.com