CVE-2006-2237

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 59.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-05-08 · updated 2026-06-16

Description

The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.

Affected products

Awstats: 6.4, 6.5

References

http://awstats.sourceforge.net/awstats_security_news.php
http://secunia.com/advisories/19969
http://secunia.com/advisories/20170
http://secunia.com/advisories/20186
http://secunia.com/advisories/20496
http://secunia.com/advisories/20710
http://security.gentoo.org/glsa/glsa-200606-06.xml
http://www.debian.org/security/2006/dsa-1058
http://www.novell.com/linux/security/advisories/2006_33_awstats.html
http://www.osreviews.net/reviews/comm/awstats
http://www.osvdb.org/25284
http://www.securityfocus.com/bid/17844

Get alerted when CVE-2006-2237 or the next vulnerability affects your stack