CVE-2005-1921

60Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendepss 79%

de la publicación al arma0 días

Publicada en NVD1 jul

1ª PoC1 jul

metasploit29 jun

probabilidad de explotación

79%top 1% de las CVE

explotación observada

noninguna fuente lo reporta

5 exploit(s) público(s)

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 5

exploitdbwww.exploit-db.com/exploits/43829no verificado exploitdbwww.exploit-db.com/exploits/16882no verificado exploitdbwww.exploit-db.com/exploits/1078no verificado exploitdbwww.exploit-db.com/exploits/1083no verificado exploitdbwww.exploit-db.com/exploits/1084no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://marc.info/?l=bugtraq&m=112008638320145&w=2 http://marc.info/?l=bugtraq&m=112015336720867&w=2 http://marc.info/?l=bugtraq&m=112605112027335&w=2 http://pear.php.net/package/XML_RPC/download/1.3.1 http://secunia.com/advisories/15810 http://secunia.com/advisories/15852 http://secunia.com/advisories/15855 http://secunia.com/advisories/15861 http://secunia.com/advisories/15872 http://secunia.com/advisories/15883 http://secunia.com/advisories/15884 http://secunia.com/advisories/15895