XML-RPC for PHP (PHPXMLRPC) contains a flaw that may allow a remote attacker to execute arbitrary PHP code. The issue is due to the 'parseRequest()' function not properly sanitizing user-supplied input. By creating an XML file that uses single quotes to escape into the 'eval()' call, a remote attacker can execute arbitrary PHP code resulting in a loss of integrity.

Upgrade to versions listed below or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

XML-RPC for PHP - 1.1.1
PostNuke - .760
Drupal - 4.5.4 / 4.6.2
XML_RPC - 1.3.1
phpMyFAQ - 1.4.9 / 1.5.0 RC5
Serendipity - 0.8.2
Nucleus CMS - 3.21
phpAdsNew - 2.0.6
phpPgAds - 2.0.6
phpGroupWare - 0.9.16.006
CamRPC - 1.0.2
eGroupWare - 1.0.0.007-3 / 1.0.0.008-2
MailWatch for MailScanner - 1.0.1
Ampache - 3.3.1.2
CivicSpace - 0.8.1
Jaws - 0.5.2
Max Media Manager - 0.1.28-rc
BLOG:CMS - 3.6.5
Eventum - 1.5.5
XOOPS - 2.2.1

• Security Tracker: 1014327 1015336
• Milw0rm: 1078
• Exploit Database: 1078
• Secunia Advisory ID: 15810 15852 15855 15861 15862 15872 15888 15892 15897 15904 15915 15920 15944 15945 15946 15947 15993 15999 16018 16029 16079 16103 16257 16619 16631 17674 18003
• Metasploit ID: 17793
• CVE ID: 2005-1921 (see also: NVD) 2005-2116 (see also: NVD)
• CERT VU: 442845
• Keyword: DRUPAL-SA-2005-003,Plupii/Lupper worm HPSBTU02083,SSRT051069
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2005-07/0008.html
  http://archives.neohapsis.com/archives/bugtraq/2005-07/0011.html
  http://archives.neohapsis.com/archives/bugtraq/2005-07/0020.html
  http://archives.neohapsis.com/archives/bugtraq/2005-07/0022.html
  http://archives.neohapsis.com/archives/bugtraq/2005-07/0180.html
  http://archives.neohapsis.com/archives/bugtraq/2005-07/0197.html
  http://archives.neohapsis.com/archives/bugtraq/2005-08/0237.html
  http://archives.neohapsis.com/archives/fulldisclosure/2005-06/0374.html
  http://archives.neohapsis.com/archives/fulldisclosure/2005-06/0382.html
  http://archives.neohapsis.com/archives/fulldisclosure/2005-06/0432.html
  http://archives.neohapsis.com/archives/fulldisclosure/2005-07/0152.html
• Other Advisory URL: http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000980
  http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:109
  http://isc.sans.org/diary.php?storyid=823
  http://lists.suse.com/archive/suse-security-announce/2005-Jul/0006.html
  http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2699
  http://securityresponse.symantec.com/avcenter/venc/data/linux.plupii.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.429041
  http://www.debian.org/security/2005/dsa-747
  http://www.debian.org/security/2005/dsa-789
  http://www.gentoo.org/security/en/glsa/glsa-200507-01.xml
  http://www.gentoo.org/security/en/glsa/glsa-200507-06.xml
  http://www.gentoo.org/security/en/glsa/glsa-200507-08.xml
  http://www.gentoo.org/security/en/glsa/glsa-200507-15.xml
  http://www.hardened-php.net/advisory-022005.php
  http://www.hardened-php.net/advisory_152005.67.html
  http://www.novell.com/linux/security/advisories/2005_49_php.html
  http://www.phpmyfaq.de/advisory_2005-06-29.php
  http://www.trustix.org/errata/2005/0031/
  http://www.ubuntulinux.org/support/documentation/usn/usn-147-1
• Vendor URL: http://drupal.org/
  http://phpxmlrpc.sourceforge.net/
• Vendor Specific News/Changelog Entry: http://drupal.org/drupal-4.6.2
  http://pear.php.net/bugs/bug.php?id=4775
  http://sourceforge.net/project/shownotes.php?release_id=338909
  http://sourceforge.net/project/shownotes.php?release_id=340210
  http://usebox.net/jjm/camrpc/ChangeLog
  http://www.freemedsoftware.org/content/view/17/2/
• Generic Exploit URL: http://metasploit.com/projects/Framework/modules/exploits/php_xmlrpc_eval.pm
• Vendor Specific Advisory URL: http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=2699
  http://phpadsnew.com/two/nucleus/index.php?itemid=45
  http://sourceforge.net/project/shownotes.php?release_id=339055
  http://www.ampache.org/announce/3_3_1_2.php
  http://www.debian.org/security/2005/dsa-745
  http://www.midgard-project.org/updates/php-xml-rpc-vulnerability.html
  http://www.novell.com/linux/security/advisories/2005_41_php_pear.html
  http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c00576921
• News Article: http://www.eweek.com/article2/0,1895,1882889,00.asp
  http://www.eweek.com/article2/0,1895,1885811,00.asp
• RedHat RHSA: RHSA-2005:564

• James Bercegay - securitygulftech.org - GulfTech Security Research