Awstats version 5.6 is not succeptable to this as it does not have the same plugin architecture. Could this be a >= 6.0 bug? Matt On Wed, 16 Feb 2005 15:52:00 -0500, Micah Brandon <brandon@xxxxxx> wrote: > > > I'm going to have to disagree. Execution of Perl functions > is still possible in 6.3. You just have to jimmy it a little and > try/guess different plugins that may be installed. I got a hit > with 'hostinfo'. Try this on your server: > > http://server/cgi-bin/awstats.pl?config=someconfig&PluginMode=hostinfo+time > > Unix time shows up just below 'Whois command failed' error message. > That's game over in my book. > > * Jamie Pratt (jpratt@xxxxxxxxxxx) [050216 01:19]: > > Still no dice on 6.3, even with the "config=www.site.org" etc,etc.. same > > error. So.. Can we all agree that 6.3 is not vulnerable, because I'd > > rather not upgrade to a dev/unstable release for no reason... > > > > regards, > > jamie > > > > Herman Sheremetyev wrote: > > >It works on mine too, though I still have 6.1. I think you may need to > > >add the config=www.example.com into the url between the '?' and the '&' > > >for it to work properly though. On my linux boxes with apache 2.0 it > > >displays the command output in the page but on openbsd with apache 1.3 > > >it gives a 500 Server Error because the output ends up in the headers > > >somehow. Either way it works though. > > > > > >-Herman > > > > >
