5 results · Feed
-
Medium —
XML-RPC for PHP allows access to local files via malicious argument to the Client::send method
Abusing the `$method` argument of Client::send, it was possible to force the client to _access local files_ or _connect to undesired urls_ instead of the intended target server's url (the one used in the Client constructor). This weakness only affects install…
-
Medium —
XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument
In order for this weakness to be exploited, the following conditions have to apply, at the same time: - method `Wrapper::buildClientWrapperCode`, or any methods which depend on it, such as `Wrapper::wrapXmlrpcServer`, `Wrapper::wrapXmlrpcMethod` or `Wrapper::…
-
Medium —
XML-RPC for PHP's debugger vulnerable to possible XSS attack
The bundled xml-rpc debugger is susceptible to XSS attacks. Since the debugger is not designed to be exposed to end users but only to the developers using this library, and in the default configuration it is not exposed to requests from the web, the likelihoo…
-
Medium —
phpxmlrpc vulnerable to argument injection
phpxmlrpc vulnerable to argument injection via local file access in `Client:send` via manipulation of `$protocol` argument.
-
High —
code injection in phpxmlrpc/phpxmlrpc
code injection in `Wrapper::buildClientWrapperCode` via manipulation of the `$client` argument. It was possible to force the client to access local files or connect to undesired urls instead of the intended target server's url.