CVE-2005-1921

Published: Jul 5, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Affected (6)

Products: Php: Xml Rpc · Gggeek: Phpxmlrpc · Drupal: Drupal · +2 more

Show all products

Php: Xml Rpc · Gggeek: Phpxmlrpc · Drupal: Drupal · Tiki: Tikiwiki Cms/groupware · Debian: Debian Linux

1 product

1 product

1 product

1 product

Tikiwiki Cms/groupware

Debian

1 product

Debian Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Php Xml Rpc	Up to 1.3.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Gggeek Phpxmlrpc	Up to 1.1

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	Before 4.5.4
Drupal Drupal	From 4.6.0 to 4.6.2

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Tiki Tikiwiki Cms/groupware	Before 1.8.5

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (100)

http://marc.info/?l=bugtraq&m=112008638320145&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=112015336720867&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=112605112027335&w=2

Source: secalert@redhat.com

Third Party Advisory

http://pear.php.net/package/XML_RPC/download/1.3.1

Source: secalert@redhat.com

PatchProduct

http://secunia.com/advisories/15810

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15852

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15855

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15861

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15872

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15883

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15884

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15895

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15903

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15904

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15916

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15917

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15922

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15944

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15947

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/15957

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16001

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16339

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16693

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/17440

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/17674

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/18003

Source: secalert@redhat.com

Broken Link

http://security.gentoo.org/glsa/glsa-200507-01.xml

Source: secalert@redhat.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200507-06.xml

Source: secalert@redhat.com

Third Party Advisory

http://security.gentoo.org/glsa/glsa-200507-07.xml

Source: secalert@redhat.com

Third Party Advisory

http://securitytracker.com/id?1015336

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://sourceforge.net/project/showfiles.php?group_id=87163

Source: secalert@redhat.com

Product

http://sourceforge.net/project/shownotes.php?release_id=338803

Source: secalert@redhat.com

Broken Link

http://www.ampache.org/announce/3_3_1_2.php

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2005/dsa-745

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2005/dsa-746

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2005/dsa-747

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2005/dsa-789

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt

Source: secalert@redhat.com

Third Party Advisory

http://www.gulftech.org/?node=research&article_id=00087-07012005

Source: secalert@redhat.com

Not ApplicableVendor Advisory

http://www.hardened-php.net/advisory-022005.php

Source: secalert@redhat.com

Not Applicable

http://www.mandriva.com/security/advisories?name=MDKSA-2005:109

Source: secalert@redhat.com

PatchThird Party AdvisoryVendor Advisory

http://www.novell.com/linux/security/advisories/2005_18_sr.html

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2005_41_php_pear.html

Source: secalert@redhat.com

Broken Link

http://www.novell.com/linux/security/advisories/2005_49_php.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2005-564.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/419064/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/14088

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2005/2827

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350

Source: secalert@redhat.com

Broken Link

http://marc.info/?l=bugtraq&m=112008638320145&w=2