Unscored severity · published May 8, 2006
CVE-2006-2237
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter
–
CVSS
59.1%
EPSS
No
On KEV
Description
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)59.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Awstats · Awstats
6.4; 6.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-2237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-2237
awstats.sourceforge.net
http://awstats.sourceforge.net/awstats_security_news.php
Patch
http://secunia.com/advisories/19969
secunia.com
http://secunia.com/advisories/20170
secunia.com
http://secunia.com/advisories/20186
secunia.com
http://secunia.com/advisories/20496
secunia.com
http://secunia.com/advisories/20710
More from Awstats
9.8
CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format
9.8
CVE-2017-1000501
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution
7.8
CVE-2025-63261
AWStats 8.0 is vulnerable to Command Injection via the open function
6.1
CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks
5.3
CVE-2020-35176
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the…