Upstream information
Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
National Vulnerability Database | |
---|---|
Base Score | 7.5 |
Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Access Vector | Network |
Access Complexity | Low |
Authentication | None |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
SUSE Security Advisories:
- SUSE-SA:2005:041, published Fri, 08 Jul 2005 16:00:00 +0000
- SUSE-SA:2005:051, published Mon, 12 Sep 2005 09:00:00 +0000
- SUSE-SR:2005:018, published Thu, 28 Jul 2005 13:00:00 +0000
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 01:29:39 2013CVE page last modified: Fri Dec 8 16:12:40 2023