Description
Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | php4 | 4:4.3.10-16etch1 | DTSA-15-1 |
| Debian 3.1 | drupal | 4.5.3-4 | DSA-840-1 |
| Debian 3.1 | egroupware | 1.0.0.007-2.dfsg-2sarge2 | DSA-842-1 |
| Debian 3.1 | php4 | 4:4.3.10-16 | DSA-789-1 |
| Debian 3.1 | phpgroupware | 0.9.16.005-3.sarge2 | DSA-798-1 |
| Debian 3.0 | php4 | 4:4.1.2-7.woody5 | DSA-789-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.8 | RHSA-2005:748 |
| RHEL 3 | php +6 | 4.3.2-25.ent | RHSA-2005:748 |
Advisories 6
- RHSA-2005:748 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-789-1 php4 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-840-1 drupal - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-842-1 egroupware - missing input sanitising Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-798-1 phpgroupware - several Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-15-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-789 vendor-advisory
- 17066 third-party-advisory
- 16441 third-party-advisory
- 20050817 [PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple vulnerabilities mailing-list
- 16491 third-party-advisory
- 16619 third-party-advisory
- 20050815 [DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue mailing-list
- SUSE-SA:2005:051 vendor-advisory
- 16460 third-party-advisory
- RHSA-2005:748 vendor-advisory
- 14560 vdb-entry
- 16558 third-party-advisory
- DSA-840 vendor-advisory
- 16431 third-party-advisory
- 16693 third-party-advisory
- FLSA:166943 vendor-advisory
- SUSE-SA:2005:049 vendor-advisory
- 17440 third-party-advisory
- 20050815 Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability mailing-list
- 16976 third-party-advisory
- GLSA-200509-19 vendor-advisory
- 16469 third-party-advisory
- 16563 third-party-advisory
- 17053 third-party-advisory
- DSA-798 vendor-advisory
- 16468 third-party-advisory
- DSA-842 vendor-advisory
- 16465 third-party-advisory
- 16635 third-party-advisory
- http://www.hardened-php.net/advisory_152005.67.html
- 16432 third-party-advisory
- oval:org.mitre.oval:def:9569 vdb-entry signature
- 16550 third-party-advisory