CVE-2008-3922

CRITICAL 9.3CVE-2008-3922 · Published 04/09/2008 · updated 16/06/2026

Package	Affected versions	Patched versions
awstats totals telartis_bv	`= 1.0= 1.1= 1.11= 1.13= 1.14`	No fix yet

Description

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

References

secunia.com/advisories/31630 · Vendor Advisory
securityreason.com/securityalert/4218
securityreason.com/securityalert/8259
userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
exploit-db.com/exploits/17324
securityfocus.com/archive/1/495770/100/0/threaded
securityfocus.com/bid/30856
telartis.nl/xcms/awstats · Patch
vupen.com/english/advisories/2008/2442
exchange.xforce.ibmcloud.com/vulnerabilities/44712
exploit-db.com/exploits/6368

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free