GitHub Advisoryadvisory · Packagist

GHSA-q7qq-9gx2-ggxv phpxmlrpc vulnerable to argument injection

MEDIUM Published 2022-12-02 Modified 2022-12-02 Official page ↗

Ecosystem: Packagist
Packages: phpxmlrpc/phpxmlrpc
Severity: Moderate
Weaknesses: CWE-88
Reviewed: 2022-12-02

Affected packages

• Packagist phpxmlrpc/phpxmlrpc: < 4.9.0 → fixed in 4.9.0

Description

phpxmlrpc vulnerable to argument injection via local file access in `Client:send` via manipulation of `$protocol` argument.

Related

Weakness · CWE (1)

CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References