PT-2022-28181 · Packagist · Phpxmlrpc/Phpxmlrpc

Published 2022-11-28 · Updated 2022-11-28

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned.

Description The issue involves code injection in the Wrapper::buildClientWrapperCode function through manipulation of the $client argument. This allows an attacker to force the client to access local files or connect to undesired URLs instead of the intended target server's URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Eval Injection

Weakness Enumeration

CWE-95

Related Identifiers

GHSA-3FGR-XJR6-XQM8

Affected Products

Phpxmlrpc/Phpxmlrpc

References · 6

• https://osv.dev/vulnerability/GHSA-3fgr-xjr6-xqm8 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/phpxmlrpc/phpxmlrpc/2022-11-28-2.yaml · Note
• https://github.com/gggeek/phpxmlrpc/commit/cf6e605e09d001ce520bfa8e7b168cfa514e663b · Note
• https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.0 · Note
• https://github.com/gggeek/phpxmlrpc · Note
• https://github.com/gggeek/phpxmlrpc/issues/80 · Note