← back
CVE-2005-1921

CVE-2005-1921

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 79%
from disclosure to weapon0 days
Published on NVDJul 1
1st PoCJul 1
metasploitJun 29
exploitation probability
79%top 1% of all CVEs
observed exploitation
nono source reports it
5 public exploit(s)
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Affected products
n/a · n/a
public PoCs found — 5
exploitdbwww.exploit-db.com/exploits/43829unverifiedexploitdbwww.exploit-db.com/exploits/16882unverifiedexploitdbwww.exploit-db.com/exploits/1078unverifiedexploitdbwww.exploit-db.com/exploits/1083unverifiedexploitdbwww.exploit-db.com/exploits/1084unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://marc.info/?l=bugtraq&m=112008638320145&w=2http://marc.info/?l=bugtraq&m=112015336720867&w=2http://marc.info/?l=bugtraq&m=112605112027335&w=2http://pear.php.net/package/XML_RPC/download/1.3.1http://secunia.com/advisories/15810http://secunia.com/advisories/15852http://secunia.com/advisories/15855http://secunia.com/advisories/15861http://secunia.com/advisories/15872http://secunia.com/advisories/15883http://secunia.com/advisories/15884http://secunia.com/advisories/15895