GitHub Advisoryadvisory · Packagist
GHSA-3fgr-xjr6-xqm8 code injection in phpxmlrpc/phpxmlrpc
HIGH
Official page ↗
- Ecosystem
- Packagist
- Packages
- phpxmlrpc/phpxmlrpc
- Severity
- High
- Weaknesses
- CWE-95
- Reviewed
- 2022-11-28
Affected packages
• Packagist phpxmlrpc/phpxmlrpc: < 4.9.0 → fixed in 4.9.0
Description
code injection in `Wrapper::buildClientWrapperCode` via manipulation of the `$client` argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url.
Related
Weakness · CWE (1)
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness
References
- https://github.com/gggeek/phpxmlrpc/issues/80 web
- https://github.com/gggeek/phpxmlrpc/commit/cf6e605e09d001ce520bfa8e7b168cfa514e663b web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpxmlrpc/phpxmlrpc/2022-11-28-2.yaml web
- https://github.com/gggeek/phpxmlrpc package
- https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.0 web