Vulnerability Note VU#471691

A1Stats multiple CGI scripts fail to adequately validate user input

Overview

A1Stats does not properly validate user input, allowing directory traversal and overwriting of files.

I. Description

A1Stats is a CGI script that provides reports on web site traffic. A1Stats does not properly filter the CGI query string. An attacker may exploit this vulnerability to traverse directories on the web server or to overwrite arbitrary files to which the web server process has write access.

II. Impact

Remote attackers can read or write any file on the server, with privileges of the web server process.

III. Solution

Upgrade

Upgrade to version 1.6 or later of A1Stats:

http://www.gadnet.com/a1stats/

Systems Affected

Vendor	Status	Date Notified	Date Updated
Drummond Miles	Vulnerable	26-Sep-2002

References

http://www.securityfocus.com/bid/2705

Credit

Thanks to neme for reporting this vulnerability.

This document was written by Shawn Van Ittersum.

Other Information

Date Public:	2001-05-07
Date First Published:	2002-09-26
Date Last Updated:	2003-02-24
CERT Advisory:
CVE-ID(s):	CAN-2001-0561
NVD-ID(s):	CAN-2001-0561
US-CERT Technical Alerts:
Severity Metric:	0.78
Document Revision:	10

If you have feedback, comments, or additional information about this vulnerability, please send us email.