17 April 2007, 12:49
Web statistics software CNStats executes external code
Multiple bugs in CNStats, a web page access analysis application, allow attackers to execute their own PHP code on a server. This may permit access to the entire system. The who_r.php and who_s.php modules fail to filter the bj and bn parameters properly, allowing paths that include local or external PHP scripts can be entered. This does, however, require register_globals to be turned on, which is contrary to security recommendations. The bug was found in version 2.9. The current version 2.12 is apparently also affected. The only remedy at present is to turn off register_globals.
- CNStats 2.9 Remote File Include Vulnerability, bug report on Milw0rm
(mba)
Print Version | Send by email
| Permalink: http://h-online.com/-732655
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
