CVE-2008-3922

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 53.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-09-04 · updated 2026-06-16
Weakness: CWE-94

Description

awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.

Affected products

Telartis Bv Awstats Totals: 1.0, 1.1, 1.11, 1.13, 1.14

References

http://secunia.com/advisories/31630
http://securityreason.com/securityalert/4218
http://securityreason.com/securityalert/8259
http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt
http://www.exploit-db.com/exploits/17324
http://www.securityfocus.com/archive/1/495770/100/0/threaded
http://www.securityfocus.com/bid/30856
http://www.telartis.nl/xcms/awstats/
http://www.vupen.com/english/advisories/2008/2442
https://exchange.xforce.ibmcloud.com/vulnerabilities/44712
https://www.exploit-db.com/exploits/6368
http://secunia.com/advisories/31630

Get alerted when CVE-2008-3922 or the next vulnerability affects your stack