CVE-2008-3922
high · 9.3awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
9.3
CVSS
53.2%
EPSS (exploit prob.)
99th
EPSS percentile
2008-09-04
Published
AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-94
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| telartis_bv | awstats_totals | 1.0 |
| telartis_bv | awstats_totals | 1.1 |
| telartis_bv | awstats_totals | 1.11 |
| telartis_bv | awstats_totals | 1.13 |
| telartis_bv | awstats_totals | 1.14 |
Check a specific version with /api/v1/cve/match.
References
- http://secunia.com/advisories/31630
- http://securityreason.com/securityalert/4218
- http://securityreason.com/securityalert/8259
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
- http://www.exploit-db.com/exploits/17324
- http://www.securityfocus.com/archive/1/495770/100/0/threaded
- http://www.securityfocus.com/bid/30856
- http://www.telartis.nl/xcms/awstats/
- http://www.vupen.com/english/advisories/2008/2442
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44712
- https://www.exploit-db.com/exploits/6368
- http://secunia.com/advisories/31630
- http://securityreason.com/securityalert/4218
- http://securityreason.com/securityalert/8259
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
- http://www.exploit-db.com/exploits/17324
- http://www.securityfocus.com/archive/1/495770/100/0/threaded
- http://www.securityfocus.com/bid/30856
- http://www.telartis.nl/xcms/awstats/
- http://www.vupen.com/english/advisories/2008/2442
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44712
- https://www.exploit-db.com/exploits/6368
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2008-3922