CVE-2008-3922 in the critical feed json
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parame…
published 2008-09-04 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-3907
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.2%
- EPSS 53.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 3
- Metasploit, Exploit-DB
Summary
awstatstotals.php in AWStats Totals 1.0 through 1.14 allows remote attackers to execute arbitrary code via PHP sequences in the sort parameter, which is used by the multisort function when dynamically creating an anonymous PHP function.
Patch / fix
Timeline
- First public exploit (Metasploit exploit/unix/webapp/awstatstotals_multisort)
- Published
Exploit prediction
53.20% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/unix/webapp/awstatstotals_multisort AWStats Totals multisort Remote Command Execution metasploit exploit, excellent rank, 2008-08-26
- EDB-17324 AWStats Totals 1.14 multisort - Remote Command Execution (Metasploit) webapps, 2011-05-25
- EDB-6368 AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution webapps, 2008-09-05
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
telartis.nl
/xcms/awstats/
patch
-
exploit-db.com
/exploits/6368
exploit
-
exploit-db.com
/exploits/17324
exploit
-
secunia.com
/advisories/31630
third-party-advisory, vendor-advisory
- userwww.service.emory.edu /~ekenda2/EMORY-2008-01.txt
-
exchange.xforce.ibmcloud.com
/vulnerabilities/44712
vdb-entry
-
securityreason.com
/securityalert/4218
third-party-advisory
-
vupen.com
/english/advisories/2008/2442
vdb-entry
-
securityreason.com
/securityalert/8259
third-party-advisory
-
securityfocus.com
/bid/30856
vdb-entry
-
securityfocus.com
/archive/1/495770/100/0/threaded
mailing-list
Sources
- CVE List CVE-2008-3922
- NVD CVE-2008-3922
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.