Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PEAR XML_RPC and PHPXMLRPC allow remote code execution

CVE-2005-1921 · published 21 years ago
Summary

The XML_RPC library and the PHPXMLRPC library, used in platforms like Drupal and TikiWiki, can run arbitrary PHP code when they process a specially crafted XML file. An attacker could take control of the server hosting the affected application. Upgrade to the latest versions of these libraries or apply the vendor's patches to stop the unsafe handling of XML data.

What to do
  • Update tiki tikiwiki_cms\/groupware to version 1.8.5 or later.
Affected software
VendorProductAffected versions
php xml_rpc <= 1.3.0
cpe:2.3:a:php:xml_rpc:*:*:*:*:*:pear:*:*
gggeek phpxmlrpc <= 1.1
cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:*
drupal drupal < 4.5.4
>= 4.6.0, < 4.6.2
cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
tiki tikiwiki_cms\/groupware < 1.8.5
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:*
debian debian_linux 3.1
cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
Original advisory text
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, ...
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
79% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published5 Jul 2005
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2005-1921 · NVD
Track software like this
Free during beta