Vulnerability Note VU#471691

A1Stats multiple CGI scripts fail to adequately validate user input

Overview

A1Stats does not properly validate user input, allowing directory traversal and overwriting of files.

I. Description

A1Stats is a CGI script that provides reports on web site traffic. A1Stats does not properly filter the CGI query string. An attacker may exploit this vulnerability to traverse directories on the web server or to overwrite arbitrary files to which the web server process has write access.

II. Impact

Remote attackers can read or write any file on the server, with privileges of the web server process.

III. Solution

Upgrade

Upgrade to version 1.6 or later of A1Stats:

http://www.gadnet.com/a1stats/

Systems Affected

Vendor	Status	Date Updated
Drummond Miles	Vulnerable	26-Sep-2002

References

http://www.securityfocus.com/bid/2705

Credit

Thanks to neme for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public	05/07/2001
Date First Published	09/26/2002 06:00:59 PM
Date Last Updated	02/24/2003
CERT Advisory
CVE Name	CAN-2001-0561
Metric	0.78
Document Revision	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.