CVE-2006-2644 Command injection in n/a
Remote authenticated users can execute arbitrary code in AWStats by uploading a configuration file with shell metacharacters and accessing it via the LogFile directive.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-2644?
CVE-2006-2644 is a medium-severity command injection vulnerability in n/a, published on 30 May 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.
Which versions are affected by CVE-2006-2644?
It affects 1 product.
Products include Awstats Awstats.
How do I fix CVE-2006-2644?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2006-2644 being exploited?
There is no known exploitation of CVE-2006-2644 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2006-2644, GHSA-cpq2-7cfm-gfc2.