Re: AWStats <= 6.4 Multiple vulnerabilities - can't reproduce in 6.3?

[Micah Brandon <brandon@xxxxxx>]

        I'm going to have to disagree.  Execution of Perl functions
is still possible in 6.3.  You just have to jimmy it a little and 
try/guess different plugins that may be installed.  I got a hit
with 'hostinfo'.  Try this on your server:

http://server/cgi-bin/awstats.pl?config=someconfig&PluginMode=hostinfo+time 

        Unix time shows up just below 'Whois command failed' error message.  
That's game over in my book.


* Jamie Pratt (jpratt@xxxxxxxxxxx) [050216 01:19]:
> Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same 
> error. So.. Can we all agree that 6.3 is not vulnerable, because I'd 
> rather not upgrade to a dev/unstable release for no reason...
> 
> regards,
> jamie
> 
> Herman Sheremetyev wrote:
> >It works on mine too, though I still have 6.1.  I think you may need to 
> >add the config=www.example.com into the url between the '?' and the '&' 
> >for it to work properly though.  On my linux boxes with apache 2.0 it 
> >displays the command output in the page but on openbsd with apache 1.3 
> >it gives a 500 Server Error because the output ends up in the headers 
> >somehow.  Either way it works though.
> >
> >-Herman
> >