1 Topic by snapsolutions (edited by snapsolutions 2005-07-05 02:03)

  • Registered: 2004-08-08
  • Posts: 508

Topic: PHP Blogging Apps Vulnerable to XML-RPC Exploits

Many popular PHP-based blogging, wiki and content management programs can be exploited through a security hole in the way PHP programs handle XML commands. The flaw allows an attacker to compromise a web server, and is found in programs including PostNuke, WordPress, Drupal, Serendipity, phpAdsNew, phpWiki and phpMyFAQ, among others.

The flaw affects the XML-RPC function, which has many uses in web applications, including "ping" update notifications for RSS feeds. PHP libraries that allow applications to exchange XML data using remote procedure calls(RPC) fail to fully check incoming data for malicious commands. The affected libraries, including PHPXMLRPC and Pear XML-RPC, are included in many interactive applications written in PHP.

Full Story...

2 Reply by hcgtv

  • hcgtv
  • hcgtv
  • Senior Member
  • Offline
  • From: Charlotte, NC
  • Registered: 2004-06-25
  • Posts: 1,991

Re: PHP Blogging Apps Vulnerable to XML-RPC Exploits

Nucleus CMS was updated already: http://www.nucleuscms.org/item/3032

PHPCrossRef . TXP Make . TXP Themes . TXP Tags . TXP Planet . We Love TXP

hcgtv's Website

  • Registered: 2005-04-01
  • Posts: 345

Re: PHP Blogging Apps Vulnerable to XML-RPC Exploits

What about PunBB?

scottywz's Website

  • From: Gothenburg, Sweden
  • Registered: 2002-05-27
  • Posts: 222

Re: PHP Blogging Apps Vulnerable to XML-RPC Exploits

PunBB doesn't use XMLRPC and is thus not affected, some mods might be though, but I don't recall any using XMLRPC either.