18889 : XML-RPC for PHP (PHPXMLRPC) Nested XML Tags Arbitrary PHP Code Execution
Printer | http://osvdb.org/18889 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
7	846	almost 8 years ago	about 5 years ago	0 times	90%

Timeline

Disclosure Date
2005-08-15

Description

XML-RPC for PHP (PHPXMLRPC) contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The problem is that the library does not properly sanitizing certain XML tags that are nested in a parsed PHP document before being used in an 'eval()' call, which may allow a remote attacker to execute arbitrary PHP code resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Contact your vendor for an appropriate upgrade. An upgrade is required as there are no known workarounds.

Products

Gaetano Giunta

XML-RPC for PHP

1.1.1

Stig S. Bakken

PEAR XML_RPC

1.3.3

Drupal	Drupal	4.5.4
		4.5.3
		4.5.2
		4.5.1
		4.5.0

Luis Argerich

TikiWiki

1.8.5

Thorsten Rinne	phpMyFAQ	1.4.10
		1.5.0 RC6

Steve Wainstead

PhpWiki

1.2.10

Wouter Demuynck

Nucleus CMS

3.2

Ralf Becker

eGroupWare

1.0.0.008-2

Joseph Engo

phpGroupWare

0.9.16.006

Akos Maroy

LiveSupport

1.0RC1

Steve Freegard

MailWatch for MailScanner

1.0.1

Matthew McNaney

phpWebSite

0.10.1

François PLANQUE

b2evolution

0.9.0

PHPAdsNew

2.0.4

References

Security Tracker: 1014674 1014676 1014677
Bugtraq ID: 14560
Secunia Advisory ID: 16429 16431 16432 16441 16460 16465 16475 16491 16512 16524 16533 16558 16563 16573 16589 16593 16619 16621 16631 16635 16648 16661 16743 16976 17053 17066 17440
CVE ID: 2005-2498 (see also: NVD)
ISS X-Force ID: 21842
Keyword: DRUPAL-SA-2005-004
Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20050901-01-U.asc http://www.debian.org/security/2005/dsa-840
http://www.gentoo.org/security/en/glsa/glsa-200508-13.xml
http://www.gentoo.org/security/en/glsa/glsa-200508-20.xml
http://www.gentoo.org/security/en/glsa/glsa-200508-21.xml
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0450.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0456.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0457.html
Vendor Specific News/Changelog Entry: http://downloads.phpgroupware.org/changelog
http://nucleuscms.org/documentation/history.html
http://pear.php.net/package/XML_RPC/download/1.4.0
Other Advisory URL: http://drupal.org/files/sa-2005-004/advisory.txt
http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:146
http://security.gentoo.org/glsa/glsa-200508-14.xml
http://security.gentoo.org/glsa/glsa-200508-18.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.481382
http://tikiwiki.org/ReleaseProcess186
http://www.debian.org/security/2005/dsa-789
http://www.debian.org/security/2005/dsa-842
http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml
http://www.hardened-php.net/advisory_142005.66.html
http://www.hardened-php.net/advisory_152005.67.html
http://www.novell.com/linux/security/advisories/2005_49_php.html
http://www.phpmyfaq.de/advisory_2005-08-15.php
http://www.ubuntulinux.org/support/documentation/usn/usn-171-1
Vendor URL: http://pear.php.net/
http://phpxmlrpc.sourceforge.net/
Generic Informational URL: http://www.computerworld.com/securitytopics/security/story/0,10801,104124,00.html
RedHat RHSA: RHSA-2005:748

Tools & Filters

	19491 19518 19532 19533 19534 19538 19568 19574 19667 19668 19809 19818 19846 19859 19863 19902 20578 21527
	3308

Credit

Stefan Esser - sesserhardened-php.net - www.hardened-php.net

CVSSv2 Score

CVSSv2 Base Score = 5.0
Source: nvd.nist.gov | Generated: 2005-08-15 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.