{"api_version":"1","generated_at":"2026-07-23T07:38:20+00:00","cve":"CVE-2005-2498","urls":{"html":"https://cve.report/CVE-2005-2498","api":"https://cve.report/api/cve/CVE-2005-2498.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-2498","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-2498"},"summary":{"title":"CVE-2005-2498","description":"Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.","state":"PUBLISHED","assigner":"redhat","published_at":"2005-08-15 04:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["CWE-94","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/14560","name":"http://www.securityfocus.com/bid/14560","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"PHPXMLRPC and PEAR XML_RPC Remote Code Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/16432","name":"http://secunia.com/advisories/16432","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Drupal XML-RPC PHP Code Execution Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16693","name":"http://secunia.com/advisories/16693","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - MAXdev MD-Pro Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16558","name":"http://secunia.com/advisories/16558","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - phpGroupWare Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=112431497300344&w=2","name":"http://marc.info/?l=bugtraq&m=112431497300344&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"'[PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16460","name":"http://secunia.com/advisories/16460","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Nucleus CMS XML-RPC Nested XML Tags PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16491","name":"http://secunia.com/advisories/16491","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - MailWatch for MailScanner XML-RPC PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16550","name":"http://secunia.com/advisories/16550","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Gentoo update for PEAR-XML_RPC / phpxmlrpc","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17440","name":"http://secunia.com/advisories/17440","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - b2evolution XML-RPC PHP Code Execution Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2005/dsa-798","name":"http://www.debian.org/security/2005/dsa-798","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Debian -- Security Information -- DSA-798-1 phpgroupware","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16431","name":"http://secunia.com/advisories/16431","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - XML-RPC for PHP Nested XML Tags PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.hardened-php.net/advisory_152005.67.html","name":"http://www.hardened-php.net/advisory_152005.67.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Not Applicable","Patch","Vendor Advisory"],"title":"Hardened-PHP Project - PHP Security\n\n      - Advisory 15/2005","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16468","name":"http://secunia.com/advisories/16468","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - phpAdsNew Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/408125","name":"http://www.securityfocus.com/archive/1/408125","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2005/dsa-842","name":"http://www.debian.org/security/2005/dsa-842","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Debian -- Security Information -- DSA-842-1 egroupware","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16976","name":"http://secunia.com/advisories/16976","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Gentoo update for php","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17053","name":"http://secunia.com/advisories/17053","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Debian update for drupal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16465","name":"http://secunia.com/advisories/16465","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - eGroupWare XML-RPC Nested XML Tags PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16635","name":"http://secunia.com/advisories/16635","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Slackware update for php","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=112605112027335&w=2","name":"http://marc.info/?l=bugtraq&m=112605112027335&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"'SUSE Security Announcement: php4, php5 remote code execution' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16441","name":"http://secunia.com/advisories/16441","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - phpMyFAQ XML-RPC Nested XML Tags PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-748.html","name":"http://www.redhat.com/support/errata/RHSA-2005-748.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"rhn.redhat.com | Red Hat Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17066","name":"http://secunia.com/advisories/17066","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - Debian update for egroupware","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16563","name":"http://secunia.com/advisories/16563","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - TikiWiki XML-RPC Nested XML Tags PHP Code Execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2005/dsa-840","name":"http://www.debian.org/security/2005/dsa-840","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"],"title":"Debian -- Security Information -- DSA-840-1 drupal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml","name":"http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Gentoo Linux Documentation\n--\n  PHP: Vulnerabilities in included PCRE and XML-RPC libraries","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://marc.info/?l=bugtraq&m=112412415822890&w=2","name":"http://marc.info/?l=bugtraq&m=112412415822890&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"'[DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.novell.com/linux/security/advisories/2005_49_php.html","name":"http://www.novell.com/linux/security/advisories/2005_49_php.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Security Announcement","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://secunia.com/advisories/16619","name":"http://secunia.com/advisories/16619","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - SUSE update for php4/php5","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16469","name":"http://secunia.com/advisories/16469","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Secunia - Advisories - phpPgAds Multiple Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html","name":"http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"The Fedora Legacy Project","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"http://www.debian.org/security/2005/dsa-789","name":"http://www.debian.org/security/2005/dsa-789","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"Debian -- Security Information -- DSA-789-1 php4","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-2498","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-2498","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"2498","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"3.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2498","vulnerable":"1","versionEndIncluding":"1.1.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"gggeek","cpe5":"phpxmlrpc","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T22:30:01.018Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"DSA-789","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2005/dsa-789"},{"name":"17066","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17066"},{"name":"16441","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16441"},{"name":"20050817 [PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=112431497300344&w=2"},{"name":"16491","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16491"},{"name":"16619","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16619"},{"name":"20050815 [DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=112412415822890&w=2"},{"name":"SUSE-SA:2005:051","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=112605112027335&w=2"},{"name":"16460","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16460"},{"name":"RHSA-2005:748","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://www.redhat.com/support/errata/RHSA-2005-748.html"},{"name":"14560","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/14560"},{"name":"16558","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16558"},{"name":"DSA-840","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2005/dsa-840"},{"name":"16431","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16431"},{"name":"16693","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16693"},{"name":"FLSA:166943","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"],"url":"http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html"},{"name":"SUSE-SA:2005:049","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://www.novell.com/linux/security/advisories/2005_49_php.html"},{"name":"17440","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17440"},{"name":"20050815 Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/408125"},{"name":"16976","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16976"},{"name":"GLSA-200509-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml"},{"name":"16469","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16469"},{"name":"16563","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16563"},{"name":"17053","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17053"},{"name":"DSA-798","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2005/dsa-798"},{"name":"16468","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16468"},{"name":"DSA-842","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2005/dsa-842"},{"name":"16465","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16465"},{"name":"16635","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16635"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.hardened-php.net/advisory_152005.67.html"},{"name":"16432","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16432"},{"name":"oval:org.mitre.oval:def:9569","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569"},{"name":"16550","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16550"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-08-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-10-10T00:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"DSA-789","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2005/dsa-789"},{"name":"17066","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17066"},{"name":"16441","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16441"},{"name":"20050817 [PHPADSNEW-SA-2005-001] phpAdsNew and phpPgAds 2.0.6 fix multiple vulnerabilities","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=112431497300344&w=2"},{"name":"16491","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16491"},{"name":"16619","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16619"},{"name":"20050815 [DRUPAL-SA-2005-004] Drupal 4.6.3 / 4.5.5 fixes critical XML-RPC issue","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=112412415822890&w=2"},{"name":"SUSE-SA:2005:051","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://marc.info/?l=bugtraq&m=112605112027335&w=2"},{"name":"16460","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16460"},{"name":"RHSA-2005:748","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://www.redhat.com/support/errata/RHSA-2005-748.html"},{"name":"14560","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/14560"},{"name":"16558","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16558"},{"name":"DSA-840","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2005/dsa-840"},{"name":"16431","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16431"},{"name":"16693","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16693"},{"name":"FLSA:166943","tags":["vendor-advisory","x_refsource_FEDORA"],"url":"http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html"},{"name":"SUSE-SA:2005:049","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://www.novell.com/linux/security/advisories/2005_49_php.html"},{"name":"17440","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17440"},{"name":"20050815 Advisory 15/2005: PHPXMLRPC Remote PHP Code Injection Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/408125"},{"name":"16976","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16976"},{"name":"GLSA-200509-19","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"http://www.gentoo.org/security/en/glsa/glsa-200509-19.xml"},{"name":"16469","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16469"},{"name":"16563","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16563"},{"name":"17053","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17053"},{"name":"DSA-798","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2005/dsa-798"},{"name":"16468","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16468"},{"name":"DSA-842","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2005/dsa-842"},{"name":"16465","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16465"},{"name":"16635","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16635"},{"tags":["x_refsource_MISC"],"url":"http://www.hardened-php.net/advisory_152005.67.html"},{"name":"16432","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16432"},{"name":"oval:org.mitre.oval:def:9569","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9569"},{"name":"16550","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16550"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2005-2498","datePublished":"2005-08-15T04:00:00.000Z","dateReserved":"2005-08-08T00:00:00.000Z","dateUpdated":"2024-08-07T22:30:01.018Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-08-15 04:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["CWE-94","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gggeek:phpxmlrpc:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.1","matchCriteriaId":"7AE79B9A-3181-4A0E-863A-646D231891DA"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*","matchCriteriaId":"A2E0C1F8-31F5-4F61-9DF7-E49B43D3C873"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"2498","Ordinal":"1","Title":"CVE-2005-2498","CVE":"CVE-2005-2498","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"2498","Ordinal":"1","NoteData":"Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR XML-RPC for PHP), as used in multiple products including (1) Drupal, (2) phpAdsNew, (3) phpPgAds, and (4) phpgroupware, allows remote attackers to execute arbitrary PHP code via certain nested XML tags in a PHP document that should not be nested, which are injected into an eval function call, a different vulnerability than CVE-2005-1921.","Type":"Description","Title":"CVE-2005-2498"},{"CveYear":"2005","CveId":"2498","Ordinal":"2","NoteData":"2005-08-15","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"2498","Ordinal":"3","NoteData":"2017-10-09","Type":"Other","Title":"Modified"}]}}}