CVE-2008-3922

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

CVSS v2.0

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

53.20% chance of exploitation in the next 30 days, 99th percentile

Published

2008-09-04

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/17324

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/awstatstotals_multis…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/17324
• https://www.exploit-db.com/exploits/6368

References

• CVE Record
• NVD entry

Related

• CVE-2008-3918
• CVE-2008-3923
• CVE-2008-3917
• CVE-2008-3924
• CVE-2008-3906
• CVE-2008-3925