Vulnerability Note VU#442845
Multiple PHP XML-RPC implementations vulnerable to code injection
A vulnerability in a common PHP extension module could allow a remote attacker to execute code on a vulnerable system.
XML-RPC is a specification and a set of implementations that allow software running on disparate operating systems and in different environments to make procedure calls over the Internet. XML-RPC uses HTTP for the transport protocol and XML for the data encoding. Several independent implementations of XML-RPC exist for PHP applications.
A common flaw in the way that several XML-RPC PHP implementations pass unsanitized user input to eval() within the XML-RPC server results in a vulnerability that could allow a remote attacker to execute code on a vulnerable system. An attacker with the ability to upload a crafted XML file could insert PHP code that would then be executed by the web application using the vulnerable XML-RPC code.
Remote attackers may be able to execute PHP code of their choosing on a vulnerable system. The code would be executed in the context of the server program that runs the corresponding web application. Secondary impacts of a compromised web service account include, but are not limited to, malicious modification of web site data, information disclosure, and access that may be leveraged to gain additional system privileges.
Upgrade or apply a patch
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Drupal||Affected||-||06 Jul 2005|
|Gentoo Linux||Affected||-||08 Jul 2005|
|Mandriva, Inc.||Affected||-||06 Jul 2005|
|PEAR XML-RPC||Affected||-||06 Jul 2005|
|phpMyFAQ||Affected||-||06 Jul 2005|
|PHPXMLRPC||Affected||-||06 Jul 2005|
|PostNuke||Affected||-||06 Jul 2005|
|Red Hat, Inc.||Affected||-||22 Dec 2005|
|Serendipity||Affected||-||08 Jul 2005|
|Trustix Secure Linux||Affected||-||06 Jul 2005|
|Ubuntu Linux||Affected||-||08 Jul 2005|
|WordPress||Affected||-||06 Jul 2005|
|XOOPS||Affected||-||06 Jul 2005|
CVSS Metrics (Learn More)
James Bercegay of the GulfTech Security Research Team reported this issue.
This document was written by Chad R Dougherty.
- CVE IDs: CVE-2005-1921
- Date Public: 29 Jun 2005
- Date First Published: 06 Jul 2005
- Date Last Updated: 09 Mar 2007
- Severity Metric: 20.75
- Document Revision: 63
If you have feedback, comments, or additional information about this vulnerability, please send us email.