RCE in Gggeek Phpxmlrpc

CVE-2005-2498

Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code…

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.051 (91.4th percentile) — read the EPSS interpretation.

Affected products

Gggeek Phpxmlrpc
Debian Debian_linux — versions 3.1
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

secalert@redhat.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_DEBIAN)
secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, Third Party Advisory)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_SECUNIA, Broken Link, third-party-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Broken Link)