CVE-2005-2498

Published: Aug 15, 2005Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.

Affected (2)

Products: Gggeek: Phpxmlrpc · Debian: Debian Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gggeek Phpxmlrpc	Up to 1.1.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (66)

http://marc.info/?l=bugtraq&m=112412415822890&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=112431497300344&w=2

Source: secalert@redhat.com

Third Party Advisory

http://marc.info/?l=bugtraq&m=112605112027335&w=2

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/16431

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16432

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16441

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16460

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16465

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16468

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16469

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16491

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16550

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16558

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16563

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16619

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16635

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16693

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/16976

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/17053

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/17066

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/17440

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2005/dsa-789

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2005/dsa-798

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2005/dsa-840

Source: secalert@redhat.com

Mailing List

http://www.debian.org/security/2005/dsa-842

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html

Source: secalert@redhat.com

Broken Link

http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml

Source: secalert@redhat.com

Third Party Advisory

http://www.hardened-php.net/advisory_152005.67.html

Source: secalert@redhat.com

Not ApplicablePatchVendor Advisory

http://www.novell.com/linux/security/advisories/2005_49_php.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2005-748.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/408125

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/14560

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569

Source: secalert@redhat.com

Broken Link

http://marc.info/?l=bugtraq&m=112412415822890&w=2