Dj7xpl has discovered some vulnerabilities in AimStats, which can be exploited by malicious people to compromise a vulnerable system.

Input passed to multiple parameters in process.php is not properly verified and sanitised before being used to write to the config.php file. This can be exploited to inject and execute arbitrary PHP code.

The vulnerabilities are confirmed in version 3.2. Other versions may also be affected.

Solution
The vendor recommends deleting the process.php file.
Further details available to Secunia VIM customers

Provided and/or discovered by
Dj7xpl

Changelog
Further details available to Secunia VIM customers

Original Advisory
AimStats:
http://www.x-pose.org/aimstats.php

http://0day.2600.ir/exploits/3762

Deep Links
Links available to Secunia VIM customers