Vulnerability record · CVE-2005-0116 · published 18 January 2005
CVE-2005-0116: AWStats configdir parameter command injection
Awstats · Awstats
AWStats versions before 6.3 pass the configdir parameter to awstats.pl without sanitizing shell metacharacters, allowing command injection. A remote attacker can run arbitrary commands with the privileges of the web server process, which is a serious risk for any exposed AWStats installation.
Description
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote command execution with a high EPSS score and public exploit code, though not currently in KEV.
What it is
AWStats versions before 6.3 pass the configdir parameter to awstats.pl without sanitizing shell metacharacters, allowing command injection. A remote attacker can run arbitrary commands with the privileges of the web server process, which is a serious risk for any exposed AWStats installation.
Impact
An unauthenticated attacker can execute arbitrary operating system commands on the host running AWStats, leading to data theft, web shell deployment, or full server compromise depending on the process privileges.
Attack surface
Reachable over the network through the awstats.pl CGI script by supplying a crafted configdir parameter; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV, but EPSS is 0.749 (99.5th percentile) and a reference is tagged Exploit, indicating public exploit code and active interest.
What to do
- Upgrade AWStats to version 6.3 or later, which contains the vendor fix.
- If upgrade is not possible, restrict access to awstats.pl to trusted networks or authenticated users.
- Run AWStats under a low-privilege account with no shell access and limited filesystem permissions.
- Validate and sanitize the configdir parameter at the web server or application layer, rejecting shell metacharacters.
Detection
- Inspect web server and AWStats logs for requests containing shell metacharacters (;, |, `, $(), &&) in the configdir parameter.
- Monitor for unexpected child processes spawned by the web server user, especially shells or command interpreters.
- Alert on outbound network connections or file writes originating from the AWStats process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://awstats.sourceforge.net/docs/awstats_changelog.txt | PatchVendor Advisory |
| http://packetstormsecurity.org/0501-exploits/AWStatsVulnAnalysis.pdf | |
| http://secunia.com/advisories/13893/ | PatchVendor Advisory |
| http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false | ExploitPatchVendor Advisory |
| http://www.kb.cert.org/vuls/id/272296 | PatchThird Party AdvisoryUS Government Resource |
| http://www.osvdb.org/13002 | |
| http://www.securityfocus.com/bid/12298 | |
| http://awstats.sourceforge.net/docs/awstats_changelog.txt | PatchVendor Advisory |
| http://packetstormsecurity.org/0501-exploits/AWStatsVulnAnalysis.pdf | |
| http://secunia.com/advisories/13893/ | PatchVendor Advisory |
| http://www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false | ExploitPatchVendor Advisory |
| http://www.kb.cert.org/vuls/id/272296 | PatchThird Party AdvisoryUS Government Resource |
| http://www.osvdb.org/13002 | |
| http://www.securityfocus.com/bid/12298 |
Track CVE-2005-0116 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-0116), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
