CVE-2006-2237 EXPLOIT
5.1
MEDIUM · CVSS 2.0 · EPSS 58.4% (pctl 99)
Patch early
A public exploit exists.
Description
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
Scoring
| CVSS | 5.1 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:H/Au:N/C:P/I:P/A:P |
| EPSS | 58.36% — more likely to be exploited than 99% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-05-08 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| awstats | awstats |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AWStats 6.4 < 6.5 - migrate Remote Command Execution (Metasploit) | 2010-07-03 |
| exploit-db | AWStats 6.5 - 'migrate' Remote Shell Command Injection | 2006-05-06 |
| exploit-db | AWStats 6.4 < 6.5 - AllowToUpdateStatsFromBrowser Command Injection (Metasploit) | 2006-05-04 |
References
- http://awstats.sourceforge.net/awstats_security_news.php
- http://secunia.com/advisories/19969
- http://secunia.com/advisories/20170
- http://secunia.com/advisories/20186
- http://secunia.com/advisories/20496
- http://secunia.com/advisories/20710
- http://security.gentoo.org/glsa/glsa-200606-06.xml
- http://www.debian.org/security/2006/dsa-1058
- http://www.novell.com/linux/security/advisories/2006_33_awstats.html
- http://www.osreviews.net/reviews/comm/awstats
- http://www.osvdb.org/25284
- http://www.securityfocus.com/bid/17844
- http://www.vupen.com/english/advisories/2006/1678
- http://www.vuxml.org/freebsd/2df297a2-dc74-11da-a22b-000c6ec775d9.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26287
- https://usn.ubuntu.com/285-1/
- http://awstats.sourceforge.net/awstats_security_news.php
- http://secunia.com/advisories/19969
- http://secunia.com/advisories/20170
- http://secunia.com/advisories/20186
→ the Explorer · watch your stack · NVD