{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-08-26T00:00:00", "descriptions": [{"lang": "en", "value": "awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "6368", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/6368"}, {"name": "17324", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "http://www.exploit-db.com/exploits/17324"}, {"tags": ["x_refsource_MISC"], "url": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.telartis.nl/xcms/awstats/"}, {"name": "awstatstotals-multisort-command-execution(44712)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44712"}, {"name": "4218", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4218"}, {"name": "ADV-2008-2442", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/2442"}, {"name": "31630", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/31630"}, {"name": "8259", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/8259"}, {"name": "30856", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30856"}, {"name": "20080826 Multiple Vulnerabilities in AWStats Totals", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/495770/100/0/threaded"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-3922", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "6368", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/6368"}, {"name": "17324", "refsource": "EXPLOIT-DB", "url": "http://www.exploit-db.com/exploits/17324"}, {"name": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt", "refsource": "MISC", "url": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt"}, {"name": "http://www.telartis.nl/xcms/awstats/", "refsource": "CONFIRM", "url": "http://www.telartis.nl/xcms/awstats/"}, {"name": "awstatstotals-multisort-command-execution(44712)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44712"}, {"name": "4218", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4218"}, {"name": "ADV-2008-2442", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/2442"}, {"name": "31630", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/31630"}, {"name": "8259", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/8259"}, {"name": "30856", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30856"}, {"name": "20080826 Multiple Vulnerabilities in AWStats Totals", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/495770/100/0/threaded"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-3922", "datePublished": "2008-09-04T18:00:00", "dateReserved": "2008-09-04T00:00:00", "dateUpdated": "2018-10-11T19:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "EB4AC543-C314-40F1-9DE7-80BC7CE8CFD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.1:*:*:*:*:*:*:*", "matchCriteriaId": "333F1513-9A70-4688-99A4-A9762D601AAE", "vulnerable": true}, {"criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "51AEF1B6-8C0A-4887-A627-2EE3B533216F", "vulnerable": true}, {"criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.13:*:*:*:*:*:*:*", "matchCriteriaId": "567AC813-9B48-41CE-B289-E2ACB6AE5EA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:telartis_bv:awstats_totals:1.14:*:*:*:*:*:*:*", "matchCriteriaId": "9A3E6A6E-668B-463D-BCF3-45A86D7F5ACE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function."}, {"lang": "es", "value": "awstatstotals.php de AWStats Totals 1.0 hasta 1.14, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de secuencias PHP en el par\u00e1metro sort que se emplea en la funci\u00f3n multisort cuando de forma din\u00e1mica se crea una funci\u00f3n PHP an\u00f3nima."}], "id": "CVE-2008-3922", "lastModified": "2018-10-11T20:50:27.780", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-09-04T18:41:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/31630"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4218"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/8259"}, {"source": "cve@mitre.org", "url": "http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt"}, {"source": "cve@mitre.org", "url": "http://www.exploit-db.com/exploits/17324"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/495770/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/30856"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.telartis.nl/xcms/awstats/"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2008/2442"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44712"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/6368"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}