{"id":"GHSA-q7qq-9gx2-ggxv","aliases":[],"title":"phpxmlrpc vulnerable to argument injection","description":"phpxmlrpc vulnerable to argument injection via  local file access in `Client:send` via manipulation of `$protocol` argument.","severity":"medium","score":null,"published":"2022-12-02T22:26:45.000Z","modified":"2024-11-28T05:34:26.730Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"phpxmlrpc/phpxmlrpc","ranges":[{"events":[{"introduced":"0"},{"fixed":"4.9.0"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.1.0","3.1.1","3.1.2","4.0.0","4.0.0-alpha","4.0.1","4.1.0","4.1.1","4.2.0","4.2.1","4.2.2","4.3.0","4.3.1","4.3.2","4.4.0","4.4.1","4.4.2","4.4.3","4.5.0","4.5.1","4.5.2","4.6.0","4.6.1","4.7.0","4.7.1","4.7.2","4.8.0","4.8.1"],"fixed":["4.9.0"]}],"references":["https://github.com/gggeek/phpxmlrpc/issues/81","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpxmlrpc/phpxmlrpc/2022-11-28-1.yaml","https://github.com/gggeek/phpxmlrpc","https://github.com/gggeek/phpxmlrpc/releases/tag/4.9.0"],"sources":[{"name":"OSV","id":"GHSA-q7qq-9gx2-ggxv","modified":"2024-11-28T05:34:26.730456Z","url":"https://osv.dev/vulnerability/GHSA-q7qq-9gx2-ggxv"}],"assessments":[]}