CVE-2008-3922

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

53.20%

Published

Sep 4, 2008

Modified

Jun 16, 2026

Public PoC / Exploit (3)

All weaponized →

TrickestTrickest PoC index Exploit-DBAWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution Exploit-DBAWStats Totals 1.14 multisort - Remote Command Execution (Metasploit)

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

Weaknesses (CWE)

CWE-94

Affected Products (5)

telartis_bv · awstats_totalsvulnerable

References (20)

http://secunia.com/advisories/31630

Vendor Advisory

http://securityreason.com/securityalert/4218

http://securityreason.com/securityalert/8259

http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt

http://www.exploit-db.com/exploits/17324

http://www.securityfocus.com/archive/1/495770/100/0/threaded

http://www.securityfocus.com/bid/30856

http://www.telartis.nl/xcms/awstats/

Patch

http://www.vupen.com/english/advisories/2008/2442

https://exchange.xforce.ibmcloud.com/vulnerabilities/44712

https://www.exploit-db.com/exploits/6368