Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2005-0116 — Improper Input Validation in Awstats

CWE-20 — Improper Input Validation13 documents9 sources
Severity
7.5HIGHNVD
EPSS
92.0%
top 0.30%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Awstats
Timeline
PublishedJan 18
Latest updateMay 1

Description

AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶Debianawstats/awstats< 6.2-1.1+3

Patches

Patch: awstats.sourceforge.net ↗Patch: secunia.com ↗Patch: www.idefense.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-3vg9-7c42-3mxf: AWStats 6↗2022-05-01
▶
CVEList
CVE-2005-0116: AWStats 6↗2005-01-19
▶
OSV
CVE-2005-0116: AWStats 6↗2005-01-18
▶
VulnCheck
awstats awstats Improper Input Validation↗2005
▶

💥Exploits & PoCs

5
Exploit-DB
AWStats 6.1 < 6.2 - 'configdir' Remote Command Execution (Metasploit)↗2009-12-26
▶
Exploit-DB
AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution↗2005-01-25
▶
Exploit-DB
AWStats 6.0 < 6.2 - 'configdir' Remote Command Execution↗2005-01-25
▶
Exploit-DB
AWStats 6.2 < 6.1 - configdir Command Injection (Metasploit)↗2005-01-15
▶
Metasploit
AWStats configdir Remote Command Execution↗
▶

📋Vendor Advisories

1
Debian
CVE-2005-0116: awstats - AWStats 6.1, and other versions before 6.3, allows remote attackers to execute a...↗2005
▶

🕵️Threat Intelligence

2
Unit42
Mirai Variant ECHOBOT Resurfaces with 13 Previously Unexploited Vulnerabilities↗2019-12-13
▶
Unit42
Mirai Variant ECHOBOT Resurfaces with 13 Previously Unexploited Vulnerabilities↗2019-12-13
▶