1. CVE-Search
  2. CVE-2005-2498
ID CVE-2005-2498
Summary Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
References
Vulnerable Configurations
  • cpe:2.3:a:edd_dumbill:phpxmlrpc:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:edd_dumbill:phpxmlrpc:1.1.1:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 11-10-2017 - 01:30)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:P/A:N
oval via4
accepted 2013-04-29T04:20:20.282-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
family unix
id oval:org.mitre.oval:def:9569
status accepted
submitted 2010-07-09T03:56:16-04:00
title Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
version 29
redhat via4
advisories
rhsa
id RHSA-2005:748
rpms
  • php-0:4.3.2-25.ent
  • php-0:4.3.9-3.8
  • php-debuginfo-0:4.3.2-25.ent
  • php-debuginfo-0:4.3.9-3.8
  • php-devel-0:4.3.2-25.ent
  • php-devel-0:4.3.9-3.8
  • php-domxml-0:4.3.9-3.8
  • php-gd-0:4.3.9-3.8
  • php-imap-0:4.3.2-25.ent
  • php-imap-0:4.3.9-3.8
  • php-ldap-0:4.3.2-25.ent
  • php-ldap-0:4.3.9-3.8
  • php-mbstring-0:4.3.9-3.8
  • php-mysql-0:4.3.2-25.ent
  • php-mysql-0:4.3.9-3.8
  • php-ncurses-0:4.3.9-3.8
  • php-odbc-0:4.3.2-25.ent
  • php-odbc-0:4.3.9-3.8
  • php-pear-0:4.3.9-3.8
  • php-pgsql-0:4.3.2-25.ent
  • php-pgsql-0:4.3.9-3.8
  • php-snmp-0:4.3.9-3.8
  • php-xmlrpc-0:4.3.9-3.8
refmap via4
bid 14560
bugtraq
  • 20050815 Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability
  • 20050815 [DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue
  • 20050817 [PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple vulnerabilities
debian
  • DSA-789
  • DSA-798
  • DSA-840
  • DSA-842
fedora FLSA:166943
gentoo GLSA-200509-19
misc http://www.hardened-php.net/advisory_152005.67.html
secunia
  • 16431
  • 16432
  • 16441
  • 16460
  • 16465
  • 16468
  • 16469
  • 16491
  • 16550
  • 16558
  • 16563
  • 16619
  • 16635
  • 16693
  • 16976
  • 17053
  • 17066
  • 17440
suse
  • SUSE-SA:2005:049
  • SUSE-SA:2005:051
Last major update 11-10-2017 - 01:30
Published 15-08-2005 - 04:00
Last modified 11-10-2017 - 01:30
Back to Top