New Search

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier as used in products such as (1) WordPress (2) Serendipity (3) Drupal (4) egroupware (5) MailWatch (6) TikiWiki (7) phpWebSite (8) Ampache and others allows remote attackers to execute arbitrary PHP code via an XML file which is not properly sanitized before being used in an eval statement.

oval:org.mitre.oval:def:11294

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier as used in products such as (1) WordPress (2) Serendipity (3) Drupal (4) egroupware (5) MailWatch (6) TikiWiki (7) phpWebSite (8) Ampache and others allows remote attackers to execute arbitrary PHP code via an XML file which is not properly sanitized before being used in an eval statement.

Family:
unix
Status:
ACCEPTED
Platform(s):
  • Oracle Linux 4
  • Red Hat Enterprise Linux 3
  • CentOS Linux 3
  • CentOS Linux 4
  • Red Hat Enterprise Linux 4
Class:
vulnerability
Reference(s):
  • CVE-2005-1921
Product(s):