Thread: [Phpwiki-talk] phpWiki Vulnerable to the XML-RPC vulnerability

Brought to you by: carstenklapp, dairiki, rurban, vargenau, wainstead

phpwiki-talk

[Phpwiki-talk] phpWiki Vulnerable to the XML-RPC vulnerability

From: GulfTech S. R. <sec...@gu...> - 2005-07-02 20:53:13

http://www.gulftech.org/?node=research&article_id=00088-07022005

An updated version can be obtained from

http://phpxmlrpc.sourceforge.net/

-- 
GulfTech Research And Development
P.O. Box 691 Gulfport, MS 39501
http://www.gulftech.org/?node=webappsec

Re: [Phpwiki-talk] phpWiki Vulnerable to the XML-RPC vulnerability

From: Reini U. <ru...@x-...> - 2005-07-03 06:24:36

GulfTech Security Research schrieb:
> http://www.gulftech.org/?node=research&article_id=00088-07022005
> 
> An updated version can be obtained from
> 
> http://phpxmlrpc.sourceforge.net/

how stupid one must be to use eval in external xmlrpc code!!
thanks for notification.

folks, please configure the PECL xmlrpc extension (php.ini: 
extension=xmlrpc) , and only use the php wrapper if absoletely necessary.
-- 
Reini Urban
http://xarch.tu-graz.ac.at/home/rurban/
http://phpwiki.org/

Re: [Phpwiki-talk] phpWiki Vulnerable to the XML-RPC vulnerability

From: Oliver B. <ob...@de...> - 2005-07-04 08:37:13

Reini Urban <ru...@x-...> wrote:

[...]

> folks, please configure the PECL xmlrpc extension (php.ini: 
> extension=xmlrpc) , and only use the php wrapper if absoletely
> necessary.

deleting/renaming *.inc in lib/XMLRPC would also help? I don't need 
(and don't like to have) rpc calls in the Wiki. Plain old browser 
access is enough.

BTW: I was not able to follow the instructions in 
http://phpwiki.sourceforge.net/demo/sidebar/HyperWiki - _where_ shall 
I press the mous button? Should there be a graph?

Oliver

Re: [Phpwiki-talk] phpWiki Vulnerable to the XML-RPC vulnerability

From: Reini U. <ru...@x-...> - 2005-07-04 12:59:03

> Reini Urban <ru...@x-...> wrote:
>> folks, please configure the PECL xmlrpc extension (php.ini:
>> extension=xmlrpc) , and only use the php wrapper if absoletely
>> necessary.
>
> deleting/renaming *.inc in lib/XMLRPC would also help? I don't need
> (and don't like to have) rpc calls in the Wiki. Plain old browser
> access is enough.

yes, deleting is recommended, until it is fixed.
The XMLRPC client (the requestor) will get an error message then.

I couldn't fix it during the weekend and today I'm also busy.
-- 
Reini Urban
http://phpwiki.org/   http://xarch.tu-graz.ac.at/home/rurban/