CVE-2005-2498

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
References
Link Resource
http://marc.info/?l=bugtraq&m=112412415822890&w=2 Third Party Advisory
http://marc.info/?l=bugtraq&m=112431497300344&w=2 Third Party Advisory
http://marc.info/?l=bugtraq&m=112605112027335&w=2 Third Party Advisory
http://secunia.com/advisories/16431 Broken Link
http://secunia.com/advisories/16432 Broken Link
http://secunia.com/advisories/16441 Broken Link
http://secunia.com/advisories/16460 Broken Link
http://secunia.com/advisories/16465 Broken Link
http://secunia.com/advisories/16468 Broken Link
http://secunia.com/advisories/16469 Broken Link
http://secunia.com/advisories/16491 Broken Link
http://secunia.com/advisories/16550 Broken Link
http://secunia.com/advisories/16558 Broken Link
http://secunia.com/advisories/16563 Broken Link
http://secunia.com/advisories/16619 Broken Link
http://secunia.com/advisories/16635 Broken Link
http://secunia.com/advisories/16693 Broken Link
http://secunia.com/advisories/16976 Broken Link
http://secunia.com/advisories/17053 Broken Link
http://secunia.com/advisories/17066 Broken Link
http://secunia.com/advisories/17440 Broken Link
http://www.debian.org/security/2005/dsa-789 Mailing List Third Party Advisory
http://www.debian.org/security/2005/dsa-798 Mailing List Third Party Advisory
http://www.debian.org/security/2005/dsa-840 Mailing List
http://www.debian.org/security/2005/dsa-842 Mailing List Third Party Advisory
http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html Broken Link
http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml Third Party Advisory
http://www.hardened-php.net/advisory_152005.67.html Not Applicable Patch Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_49_php.html Broken Link
http://www.redhat.com/support/errata/RHSA-2005-748.html Broken Link
http://www.securityfocus.com/archive/1/408125 Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/14560 Broken Link Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569 Broken Link
Configurations

Configuration 1 (hide)

cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*

History

14 Feb 2024, 15:47

Type Values Removed Values Added
References () http://marc.info/?l=bugtraq&m=112412415822890&w=2 - () http://marc.info/?l=bugtraq&m=112412415822890&w=2 - Third Party Advisory
References () http://marc.info/?l=bugtraq&m=112431497300344&w=2 - () http://marc.info/?l=bugtraq&m=112431497300344&w=2 - Third Party Advisory
References () http://marc.info/?l=bugtraq&m=112605112027335&w=2 - () http://marc.info/?l=bugtraq&m=112605112027335&w=2 - Third Party Advisory
References () http://secunia.com/advisories/16431 - () http://secunia.com/advisories/16431 - Broken Link
References () http://secunia.com/advisories/16432 - () http://secunia.com/advisories/16432 - Broken Link
References () http://secunia.com/advisories/16441 - () http://secunia.com/advisories/16441 - Broken Link
References () http://secunia.com/advisories/16460 - () http://secunia.com/advisories/16460 - Broken Link
References () http://secunia.com/advisories/16465 - () http://secunia.com/advisories/16465 - Broken Link
References () http://secunia.com/advisories/16468 - () http://secunia.com/advisories/16468 - Broken Link
References () http://secunia.com/advisories/16469 - () http://secunia.com/advisories/16469 - Broken Link
References () http://secunia.com/advisories/16491 - () http://secunia.com/advisories/16491 - Broken Link
References () http://secunia.com/advisories/16550 - () http://secunia.com/advisories/16550 - Broken Link
References () http://secunia.com/advisories/16558 - () http://secunia.com/advisories/16558 - Broken Link
References () http://secunia.com/advisories/16563 - () http://secunia.com/advisories/16563 - Broken Link
References () http://secunia.com/advisories/16619 - () http://secunia.com/advisories/16619 - Broken Link
References () http://secunia.com/advisories/16635 - () http://secunia.com/advisories/16635 - Broken Link
References () http://secunia.com/advisories/16693 - () http://secunia.com/advisories/16693 - Broken Link
References () http://secunia.com/advisories/16976 - () http://secunia.com/advisories/16976 - Broken Link
References () http://secunia.com/advisories/17053 - () http://secunia.com/advisories/17053 - Broken Link
References () http://secunia.com/advisories/17066 - () http://secunia.com/advisories/17066 - Broken Link
References () http://secunia.com/advisories/17440 - () http://secunia.com/advisories/17440 - Broken Link
References () http://www.debian.org/security/2005/dsa-789 - () http://www.debian.org/security/2005/dsa-789 - Mailing List, Third Party Advisory
References () http://www.debian.org/security/2005/dsa-798 - () http://www.debian.org/security/2005/dsa-798 - Mailing List, Third Party Advisory
References () http://www.debian.org/security/2005/dsa-840 - () http://www.debian.org/security/2005/dsa-840 - Mailing List
References () http://www.debian.org/security/2005/dsa-842 - () http://www.debian.org/security/2005/dsa-842 - Mailing List, Third Party Advisory
References () http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html - () http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html - Broken Link
References () http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml - () http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml - Third Party Advisory
References () http://www.hardened-php.net/advisory_152005.67.html - Patch, Vendor Advisory () http://www.hardened-php.net/advisory_152005.67.html - Not Applicable, Patch, Vendor Advisory
References () http://www.novell.com/linux/security/advisories/2005_49_php.html - () http://www.novell.com/linux/security/advisories/2005_49_php.html - Broken Link
References () http://www.redhat.com/support/errata/RHSA-2005-748.html - () http://www.redhat.com/support/errata/RHSA-2005-748.html - Broken Link
References () http://www.securityfocus.com/archive/1/408125 - () http://www.securityfocus.com/archive/1/408125 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securityfocus.com/bid/14560 - () http://www.securityfocus.com/bid/14560 - Broken Link, Third Party Advisory, VDB Entry
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569 - Broken Link
CVSS v2 : 5.0
v3 : unknown
v2 : 7.5
v3 : unknown
CWE NVD-CWE-Other CWE-94
CPE cpe:2.3:a:edd_dumbill:phpxmlrpc:1.1.1:*:*:*:*:*:*:* cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
First Time Debian
Debian debian Linux
Gggeek phpxmlrpc
Gggeek

Information

Published : 2005-08-15 04:00

Updated : 2024-02-14 15:47


NVD link : CVE-2005-2498

Mitre link : CVE-2005-2498

CVE.ORG link : CVE-2005-2498


JSON object : View

Products Affected

gggeek

  • phpxmlrpc

debian

  • debian_linux
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')