phpWebSite: Arbitrary command execution through XML-RPC and SQL injection — GLSA 200508-21

phpWebSite is vulnerable to multiple issues which result in the execution of arbitrary code and SQL injection.

Affected packages

Background

phpWebSite is a web site content management system.

Description

phpWebSite uses an XML-RPC library that improperly handles XML-RPC requests and responses with malformed nested tags. Furthermore, "matrix_killer" reported that phpWebSite is vulnerable to an SQL injection attack.

Impact

A malicious remote user could exploit this vulnerability to inject arbitrary PHP script code into eval() statements by sending a specially crafted XML document, and also inject SQL commands to access the underlying database directly.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=www-apps/phpwebsite-0.10.2_rc2"

References

• CAN-2005-2498
• Original Advisory

Release date
August 31, 2005

Latest revision
August 31, 2005: 01

Severity
high

Exploitable
remote

Bugzilla entries

• 102785