Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
14 Feb 2024, 15:41
Type | Values Removed | Values Added |
---|---|---|
First Time |
Debian
Tiki tikiwiki Cms\/groupware Drupal Debian debian Linux Tiki Gggeek Gggeek phpxmlrpc Php xml Rpc Drupal drupal Php |
|
CWE | CWE-94 | |
References | () http://marc.info/?l=bugtraq&m=112008638320145&w=2 - Third Party Advisory | |
References | () http://marc.info/?l=bugtraq&m=112015336720867&w=2 - Third Party Advisory | |
References | () http://marc.info/?l=bugtraq&m=112605112027335&w=2 - Third Party Advisory | |
References | () http://pear.php.net/package/XML_RPC/download/1.3.1 - Patch, Product | |
References | () http://secunia.com/advisories/15810 - Broken Link | |
References | () http://secunia.com/advisories/15852 - Broken Link | |
References | () http://secunia.com/advisories/15855 - Broken Link | |
References | () http://secunia.com/advisories/15861 - Broken Link | |
References | () http://secunia.com/advisories/15872 - Broken Link | |
References | () http://secunia.com/advisories/15883 - Broken Link | |
References | () http://secunia.com/advisories/15884 - Broken Link | |
References | () http://secunia.com/advisories/15895 - Broken Link | |
References | () http://secunia.com/advisories/15903 - Broken Link | |
References | () http://secunia.com/advisories/15904 - Broken Link | |
References | () http://secunia.com/advisories/15916 - Broken Link | |
References | () http://secunia.com/advisories/15917 - Broken Link | |
References | () http://secunia.com/advisories/15922 - Broken Link | |
References | () http://secunia.com/advisories/15944 - Broken Link | |
References | () http://secunia.com/advisories/15947 - Broken Link | |
References | () http://secunia.com/advisories/15957 - Broken Link | |
References | () http://secunia.com/advisories/16001 - Broken Link | |
References | () http://secunia.com/advisories/16339 - Broken Link | |
References | () http://secunia.com/advisories/16693 - Broken Link | |
References | () http://secunia.com/advisories/17440 - Broken Link | |
References | () http://secunia.com/advisories/17674 - Broken Link | |
References | () http://secunia.com/advisories/18003 - Broken Link | |
References | () http://security.gentoo.org/glsa/glsa-200507-01.xml - Third Party Advisory | |
References | () http://security.gentoo.org/glsa/glsa-200507-06.xml - Third Party Advisory | |
References | () http://security.gentoo.org/glsa/glsa-200507-07.xml - Third Party Advisory | |
References | () http://securitytracker.com/id?1015336 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://sourceforge.net/project/showfiles.php?group_id=87163 - Product | |
References | () http://sourceforge.net/project/shownotes.php?release_id=338803 - Broken Link | |
References | () http://www.ampache.org/announce/3_3_1_2.php - Broken Link | |
References | () http://www.debian.org/security/2005/dsa-745 - Mailing List, Third Party Advisory | |
References | () http://www.debian.org/security/2005/dsa-746 - Mailing List, Third Party Advisory | |
References | () http://www.debian.org/security/2005/dsa-747 - Mailing List, Third Party Advisory | |
References | () http://www.debian.org/security/2005/dsa-789 - Mailing List, Third Party Advisory | |
References | () http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt - Third Party Advisory | |
References | () http://www.gulftech.org/?node=research&article_id=00087-07012005 - Not Applicable, Vendor Advisory | |
References | () http://www.hardened-php.net/advisory-022005.php - Not Applicable | |
References | () http://www.mandriva.com/security/advisories?name=MDKSA-2005:109 - Patch, Third Party Advisory, Vendor Advisory | |
References | () http://www.novell.com/linux/security/advisories/2005_18_sr.html - Broken Link | |
References | () http://www.novell.com/linux/security/advisories/2005_41_php_pear.html - Broken Link | |
References | () http://www.novell.com/linux/security/advisories/2005_49_php.html - Broken Link | |
References | () http://www.redhat.com/support/errata/RHSA-2005-564.html - Broken Link | |
References | () http://www.securityfocus.com/archive/1/419064/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/14088 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.vupen.com/english/advisories/2005/2827 - Broken Link | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294 - Broken Link | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350 - Broken Link | |
CPE | cpe:2.3:a:pear:xml_rpc:1.2.0rc6:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.1:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc1:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc3:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc4:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.2:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc2:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.3.0rc1:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.0.2:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.3.0rc2:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc5:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.1.0:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.0.3:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.0.4:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0rc7:*:*:*:*:*:*:* cpe:2.3:a:pear:xml_rpc:1.2.0:*:*:*:*:*:*:* |
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* cpe:2.3:a:php:xml_rpc:*:*:*:*:*:pear:*:* cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:* cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:* |
Information
Published : 2005-07-05 04:00
Updated : 2024-02-14 15:41
NVD link : CVE-2005-1921
Mitre link : CVE-2005-1921
CVE.ORG link : CVE-2005-1921
JSON object : View
Products Affected
php
- xml_rpc
drupal
- drupal
tiki
- tikiwiki_cms\/groupware
debian
- debian_linux
gggeek
- phpxmlrpc
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')