CVE-2005-1921
High
Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Gggeek Phpxmlrpc
PublishedJul 5, 2005
First seenJul 5, 2005
How to fix
Update
- drupal drupal4.5.4, 4.6.2 or later
- tiki tikiwiki_cms\/groupware1.8.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gggeek phpxmlrpc | v ≤ 1.1 | — |
| php xml_rpc | v ≤ 1.3.0 | — |
| drupal drupal | v < 4.5.4, 4.6.0 ≤ v < 4.6.2 | 4.5.4, 4.6.2 |
| tiki tikiwiki_cms\/groupware | v < 1.8.5 | 1.8.5 |
| debian debian_linux | 3.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.