Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | php4 | 4:4.3.10-16etch1 | DTSA-15-1 |
| Debian 3.1 | drupal | 4.5.3-3 | DSA-745-1 |
| Debian 3.1 | egroupware | 1.0.0.007-2.dfsg-2sarge1 | DSA-747-1 |
| Debian 3.1 | php4 | 4:4.3.10-16 | DSA-789-1 |
| Debian 3.1 | phpgroupware | 0.9.16.005-3.sarge0 | DSA-746-1 |
| Debian 3.0 | php4 | 4:4.1.2-7.woody5 | DSA-789-1 |
| Debian 3.0 | phpgroupware | No fix yet | DSA-746-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.7 | RHSA-2005:564 |
| RHEL 3 | php +6 | 4.3.2-24.ent | RHSA-2005:564 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
PHP XML-RPC Arbitrary Code Execution
exploit/unix/webapp/php_xmlrpc_eval
Exploit-DB 5
- PHPXMLRPC < 1.1 - Remote Code Execution EDB-43829 · webapps · Jul 2, 2015
- XML-RPC Library 1.3.0 - 'xmlrpc.php' Arbitrary Code Execution (Metasploit) EDB-16882 · webapps · Jul 25, 2010 · verified
- XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2) EDB-1083 · webapps · Jul 4, 2005 · verified
- XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3) EDB-1084 · webapps · Jul 4, 2005 · verified
- XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection EDB-1078 · webapps · Jul 1, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2005:564 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-789-1 php4 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-747-1 egroupware - input validation error Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-746-1 phpgroupware - remote command execution Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-745-1 drupal - arbitrary command execution Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-15-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:350 vdb-entry signature
- DSA-789 vendor-advisory
- 15947 third-party-advisory
- 15852 third-party-advisory
- 15944 third-party-advisory
- SUSE-SR:2005:018 vendor-advisory
- 15883 third-party-advisory
- 15872 third-party-advisory
- 15895 third-party-advisory
- oval:org.mitre.oval:def:11294 vdb-entry signature
- 1015336 vdb-entry
- DSA-746 vendor-advisory
- 17674 third-party-advisory
- http://www.gulftech.org/?node=research&article_id=00087-07012005
- ADV-2005-2827 vdb-entry
- 15917 third-party-advisory
- DSA-747 vendor-advisory
- SUSE-SA:2005:041 vendor-advisory
- http://www.hardened-php.net/advisory-022005.php
- SSRT051069 vendor-advisory
- SUSE-SA:2005:051 vendor-advisory
- 15957 third-party-advisory
- http://www.ampache.org/announce/3_3_1_2.php
- 15810 third-party-advisory
- GLSA-200507-01 vendor-advisory
- http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt
- 14088 vdb-entry
- 16693 third-party-advisory
- 20050629 Advisory 02/2005: Remote code execution in Serendipity mailing-list
- 20050629 [DRUPAL-SA-2005-003] Drupal 4.6.2 / 4.5.4 fixes critical XML-RPC issue mailing-list
- GLSA-200507-07 vendor-advisory
- 15904 third-party-advisory
- 15903 third-party-advisory
- SUSE-SA:2005:049 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=338803
- 17440 third-party-advisory
- 15922 third-party-advisory
- 15884 third-party-advisory
- 15916 third-party-advisory
- RHSA-2005:564 vendor-advisory
- http://pear.php.net/package/XML_RPC/download/1.3.1
- 16001 third-party-advisory
- http://sourceforge.net/project/showfiles.php?group_id=87163
- MDKSA-2005:109 vendor-advisory
- GLSA-200507-06 vendor-advisory
- DSA-745 vendor-advisory
- 15855 third-party-advisory
- 16339 third-party-advisory
- 18003 third-party-advisory
- 15861 third-party-advisory