Gentoo Linux Security Advisory GLSA 200606-06 – Hendrik Weimer has found that if updating the statistics via the web frontend is enabled, it is possible to inject arbitrary code via a pipe character in the migrate parameter. Additionally, r0t has discovered that AWStats fails to properly sanitize user-supplied input in awstats.pl. Versions less than 6.5-r1 are affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/47174/glsa-200606-06.txt
Source: https://packetstormsecurity.com/files/47174/Gentoo-Linux-Security-Advisory-200606-6.html