ID CVE-2005-1921
Summary Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
References
Vulnerable Configurations
  • cpe:2.3:a:pear:xml_rpc:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc1:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc2:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc2:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc3:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc3:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc4:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc4:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc5:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc5:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc6:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc6:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.0rc7:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.0rc7:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.3.0rc1:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.3.0rc1:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.3.0rc2:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.3.0rc2:*:*:*:*:*:*:*
  • cpe:2.3:a:pear:xml_rpc:1.3.0rc3:*:*:*:*:*:*:*
    cpe:2.3:a:pear:xml_rpc:1.3.0rc3:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 19-10-2018 - 15:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
  • accepted 2013-04-29T04:12:58.707-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
    family unix
    id oval:org.mitre.oval:def:11294
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
    version 29
  • accepted 2005-09-21T01:33:00.000-04:00
    class vulnerability
    contributors
    name Jay Beale
    organization Bastille Linux
    description Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
    family unix
    id oval:org.mitre.oval:def:350
    status accepted
    submitted 2005-07-19T12:00:00.000-04:00
    title PEAR XML_RPC PHP Code Execution Vulnerability
    version 4
redhat via4
advisories
rhsa
id RHSA-2005:564
rpms
  • php-0:4.3.2-24.ent
  • php-0:4.3.9-3.7
  • php-debuginfo-0:4.3.2-24.ent
  • php-debuginfo-0:4.3.9-3.7
  • php-devel-0:4.3.2-24.ent
  • php-devel-0:4.3.9-3.7
  • php-domxml-0:4.3.9-3.7
  • php-gd-0:4.3.9-3.7
  • php-imap-0:4.3.2-24.ent
  • php-imap-0:4.3.9-3.7
  • php-ldap-0:4.3.2-24.ent
  • php-ldap-0:4.3.9-3.7
  • php-mbstring-0:4.3.9-3.7
  • php-mysql-0:4.3.2-24.ent
  • php-mysql-0:4.3.9-3.7
  • php-ncurses-0:4.3.9-3.7
  • php-odbc-0:4.3.2-24.ent
  • php-odbc-0:4.3.9-3.7
  • php-pear-0:4.3.9-3.7
  • php-pgsql-0:4.3.2-24.ent
  • php-pgsql-0:4.3.9-3.7
  • php-snmp-0:4.3.9-3.7
  • php-xmlrpc-0:4.3.9-3.7
refmap via4
bid 14088
bugtraq
  • 20050629 Advisory 02/2005: Remote code execution in Serendipity
  • 20050629 [DRUPAL-SA-2005-003] Drupal 4.6.2 / 4.5.4 fixes critical XML-RPC issue
confirm
debian
  • DSA-745
  • DSA-746
  • DSA-747
  • DSA-789
gentoo
  • GLSA-200507-01
  • GLSA-200507-06
  • GLSA-200507-07
hp
  • HPSBTU02083
  • SSRT051069
mandrake MDKSA-2005:109
misc
sectrack 1015336
secunia
  • 15810
  • 15852
  • 15855
  • 15861
  • 15872
  • 15883
  • 15884
  • 15895
  • 15903
  • 15904
  • 15916
  • 15917
  • 15922
  • 15944
  • 15947
  • 15957
  • 16001
  • 16339
  • 16693
  • 17440
  • 17674
  • 18003
suse
  • SUSE-SA:2005:041
  • SUSE-SA:2005:049
  • SUSE-SA:2005:051
  • SUSE-SR:2005:018
vupen ADV-2005-2827
Last major update 19-10-2018 - 15:32
Published 05-07-2005 - 04:00
Last modified 19-10-2018 - 15:32
Back to Top