phpMyFAQ XML-RPC for PHP Nested Tags Remote Code Execution

[TJ]

* Technical Description *

A vulnerability was identified in phpMyFAQ, which could be exploited by remote attackers to execute arbitrary code. This flaw is due to an input validation error in the XML-RPC library when processing, via an "eval()" call, certain XML tags nested in parsed documents, which could be exploited by remote attackers to execute arbitrary PHP commands. For additional information, see : FrSIRT/ADV-2005-1413

 * Affected Products *

phpMyFAQ version 1.4.10 and prior
phpMyFAQ version 1.5.0-RC6 and prior

 * Solution *

Upgrade to phpMyFAQ version 1.4.11 :
http://www.phpmyfaq.de/download.php

 * References *

http://www.frsirt.com/english/advisories/2005/1416
http://www.phpmyfaq.de/advisory_2005-08-15.php