awstats -- arbitrary command execution

Several input validation errors exist in AWStats that allow a
remote unauthenticated attacker to execute arbitrary commands
with the priviliges of the web server. These programming
errors involve CGI parameters including
loadplugin, logfile,
pluginmode, update, and possibly
others.
Additionally, the debug and other CGI parameters
may be used to cause AWStats to disclose AWStats and system
configuration information.