OSVDB ID: 18889

Title: XML-RPC for PHP (PHPXMLRPC) Nested XML Tags Arbitrary PHP Code Execution

Info

Disclosure

Aug 15, 2005

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

XML-RPC for PHP (PHPXMLRPC) contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The problem is that the library does not properly sanitizing certain XML tags that are nested in a parsed PHP document before being used in an 'eval()' call, which may allow a remote attacker to execute arbitrary PHP code resulting in a loss of integrity.

Classification

Location: Remote/Network Access Required
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Rumored / Private
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Contact your vendor for an appropriate upgrade. An upgrade is required as there are no known workarounds.

Products

Gaetano Giunta

XML-RPC for PHP

1.1.1

Stig S. Bakken

PEAR XML_RPC

1.3.3

Drupal	Drupal	4.5.4
		4.5.3
		4.5.2
		4.5.1
		4.5.0

Luis Argerich

TikiWiki

1.8.5

Thorsten Rinne	phpMyFAQ	1.4.10
		1.5.0 RC6

Steve Wainstead

PhpWiki

1.2.10

Wouter Demuynck

Nucleus CMS

3.2

Ralf Becker

eGroupWare

1.0.0.008-2

Joseph Engo

phpGroupWare

0.9.16.006

Akos Maroy

LiveSupport

1.0RC1

Steve Freegard

MailWatch for MailScanner

1.0.1

Matthew McNaney

phpWebSite

0.10.1

François PLANQUE

b2evolution

0.9.0

PHPAdsNew

PHPAdsNew

2.0.4

References

Security Tracker: 1014674 1014676 1014677
Bugtraq ID: 14560
Secunia Advisory ID: 16429 16431 16432 16441 16460 16465 16475 16491 16512 16524 16533 16558 16563 16573 16589 16593 16619 16621 16631 16635 16648 16661 16743 16976 17053 17066 17440
CVE ID: 2005-2498 (see also: NVD)
ISS X-Force ID: 21842
Keyword: DRUPAL-SA-2005-004
Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20050901-01-U.asc http://www.debian.org/security/2005/dsa-840
http://www.gentoo.org/security/en/glsa/glsa-200508-13.xml
http://www.gentoo.org/security/en/glsa/glsa-200508-20.xml
http://www.gentoo.org/security/en/glsa/glsa-200508-21.xml
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0450.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0456.html
http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0457.html
Vendor Specific News/Changelog Entry: http://downloads.phpgroupware.org/changelog
http://nucleuscms.org/documentation/history.html
http://pear.php.net/package/XML_RPC/download/1.4.0
Other Advisory URL: http://drupal.org/files/sa-2005-004/advisory.txt
http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:146
http://security.gentoo.org/glsa/glsa-200508-14.xml
http://security.gentoo.org/glsa/glsa-200508-18.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware- ......
http://tikiwiki.org/ReleaseProcess186
http://www.debian.org/security/2005/dsa-789
http://www.debian.org/security/2005/dsa-842
http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml
http://www.hardened-php.net/advisory_142005.66.html
http://www.hardened-php.net/advisory_152005.67.html
http://www.novell.com/linux/security/advisories/2005_49_php.html
http://www.phpmyfaq.de/advisory_2005-08-15.php
http://www.ubuntulinux.org/support/documentation/usn/usn-171-1
Vendor URL: http://pear.php.net/
http://phpxmlrpc.sourceforge.net/
Generic Informational URL: http://www.computerworld.com/securitytopics/security/story/0,10801,104124,00.html ......
RedHat RHSA: RHSA-2005:748

Credit

Stefan Esser - sesserhardened-php.net - www.hardened-php.net

Direct URL: http://osvdb.org/36218