CVE-2006-2237
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote...
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
Exploit likelihood
What each source reports
NVD Score used
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- Updated
- 2026-11-02
EUVDEUVD-2006-2238No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
EUVD-2006-2238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4mq-2mhg-3c5xNo score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote...
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
GHSA-x4mq-2mhg-3c5x- Updated
- 2026-11-02
OSVNo score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2237No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
DEBIAN-CVE-2006-2237- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | AWStats 6.4 < 6.5 - AllowToUpdateStatsFromBrowser Command Injection (Metasploit) | 2006-05-04 |
| Metasploit | AWStats migrate Remote Command Execution | 2006-05-04 |
| Exploit-DB | AWStats 6.5 - 'migrate' Remote Shell Command Injection | 2006-05-06 |
| Exploit-DB | AWStats 6.4 < 6.5 - migrate Remote Command Execution (Metasploit) | 2010-07-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2237 is a medium vulnerability (CVSS 5.1) in Awstats, published May 8, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 59.1%, the 99th percentile. Fixed in awstats 6.5-2.
References
secunia.com/advisories/20710
awstats.sourceforge.net/awstats_security_news.php
debian.org/security/2006/dsa-1058
exchange.xforce.ibmcloud.com/vulnerabilities/26287
Show 13 moreShow less
vupen.com/english/advisories/2006/1678
osreviews.net/reviews/comm/awstats
osvdb.org/25284
usn.ubuntu.com/285-1
vuxml.org/freebsd/2df297a2-dc74-11da-a22b-000c6ec775d9.html
security.gentoo.org/glsa/glsa-200606-06.xml
novell.com/linux/security/advisories/2006_33_awstats.html
securityfocus.com/bid/17844
nvd.nist.gov/vuln/detail/CVE-2006-2237
github.com/advisories/GHSA-x4mq-2mhg-3c5x
security-tracker.debian.org/tracker/CVE-2006-2237