CVEvulnerability

CVE-2005-1921

7.5 HIGH Published 2005-07-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-07-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Affected configurations

• php xml rpc (<= 1.3.0) • gggeek phpxmlrpc (<= 1.1) • drupal drupal (< 4.5.4) • drupal drupal (>= 4.6.0 < 4.6.2) • tiki tikiwiki cms\/groupware (< 1.8.5) • debian debian linux 3.1

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

Referenced by CWE · observed example (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References