CVE-2008-3922 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 53.2% (pctl 99)
Patch early
A public exploit exists.
Description
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 53.2% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-09-04 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| telartis bv | awstats totals |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | AWStats Totals 1.14 multisort - Remote Command Execution (Metasploit) | 2011-05-25 |
| exploit-db | AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution | 2008-09-05 |
References
- http://secunia.com/advisories/31630
- http://securityreason.com/securityalert/4218
- http://securityreason.com/securityalert/8259
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
- http://www.exploit-db.com/exploits/17324
- http://www.securityfocus.com/archive/1/495770/100/0/threaded
- http://www.securityfocus.com/bid/30856
- http://www.telartis.nl/xcms/awstats/
- http://www.vupen.com/english/advisories/2008/2442
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44712
- https://www.exploit-db.com/exploits/6368
- http://secunia.com/advisories/31630
- http://securityreason.com/securityalert/4218
- http://securityreason.com/securityalert/8259
- http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
- http://www.exploit-db.com/exploits/17324
- http://www.securityfocus.com/archive/1/495770/100/0/threaded
- http://www.securityfocus.com/bid/30856
- http://www.telartis.nl/xcms/awstats/
- http://www.vupen.com/english/advisories/2008/2442
→ the Explorer · watch your stack · NVD