CVEvulnerability

CVE-2005-2498

7.5 HIGH Published 2005-08-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2005-08-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-94

Description

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.

Affected configurations

• gggeek phpxmlrpc (<= 1.1.1) • debian debian linux 3.1

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

Referenced by CWE · observed example (2)

  • CWE-94 Improper Control of Generation of Code weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References