Vulnerability record · CVE-2006-2237 · published 8 May 2006
CVE-2006-2237: AWStats web interface command injection via migrate parameter
Awstats · Awstats
AWStats 6.4 and 6.5 expose a web interface that, when statistics updates are enabled, passes the migrate parameter to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject commands that execute with the privileges of the AWStats process. The flaw matters because it turns a statistics reporting tool into a remote code execution vector on any host running an affected version with updates enabled.
Description
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
AV:N/AC:H/Au:N/C:P/I:P/A:P
Automated analysis
high priorityUnauthenticated remote command execution with a very high EPSS score, though the CVSS 2.0 base of 5.1 and the requirement that statistics updates be enabled temper the rating.
What it is
AWStats 6.4 and 6.5 expose a web interface that, when statistics updates are enabled, passes the migrate parameter to a shell without sanitizing shell metacharacters. An unauthenticated remote attacker can therefore inject commands that execute with the privileges of the AWStats process. The flaw matters because it turns a statistics reporting tool into a remote code execution vector on any host running an affected version with updates enabled.
Impact
An attacker gains arbitrary command execution on the server hosting AWStats, under the web server or AWStats process account. That access can be used to read or alter data, pivot to other services, or establish persistence.
Attack surface
Reached over the network through the AWStats web interface, per the AV:N vector, with no authentication required (Au:N). The description ties exploitability to statistics updates being enabled, so deployments with that feature off are not exposed.
Exploitation
Not listed in CISA KEV and no reference carries an exploit tag, but EPSS is 0.58356 (99th percentile), indicating a high modeled likelihood of exploitation activity. No public exploit code is confirmed by the supplied record.
What to do
- Upgrade AWStats past 6.4 and 6.5 to a fixed release; vendor and distro advisories (Secunia, Debian DSA-1058, Gentoo GLSA-200606-06, Ubuntu USN-285-1, Novell) list patched packages.
- If upgrading is not immediately possible, disable statistics updates in the AWStats web interface so the migrate parameter is not processed.
- Restrict access to the AWStats web interface to trusted networks or authenticated users via web server access controls.
- Run AWStats under a low-privilege account with no shell access and limit its filesystem and network reach.
- Monitor vendor and distribution advisories for the affected AWStats versions and apply the corresponding package updates.
Detection
- Inspect web server and AWStats logs for requests containing shell metacharacters (;, |, `, $(), &&) in the migrate parameter.
- Alert on AWStats processes spawning unexpected child processes such as sh, bash, curl, wget, or nc.
- Review AWStats configuration to confirm whether statistics updates are enabled and flag hosts where they are.
- Baseline outbound connections from the AWStats host and alert on new destinations following web interface requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2006-2237 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2006-2237), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
