Unscored severity · published Jan 9, 2006
CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7)…
–
CVSS
13.2%
EPSS
No
On KEV
Description
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)13.2% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Adodb · John Lim
4.66; 4.68 · source: NVD
CA
Cacti · The Cacti Group
0.8.6g · source: NVD
MA
Mantis · Mantis
0.19.4; 1.0.0_rc4 · source: NVD
ME
Mediabeez · Mediabeez
All versions, or not specified · source: NVD
MO
Moodle · Moodle
1.5.3 · source: NVD
PO
Postnuke · Postnuke Software Foundation
0.761 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0146
Exploit
http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
Exploit
http://secunia.com/advisories/17418
Patch
http://secunia.com/advisories/18233
Vendor Advisory
http://secunia.com/advisories/18254
Patch
http://secunia.com/advisories/18260
Vendor Advisory
http://secunia.com/advisories/18267
More from Adodb
–
CVE-2011-3699
John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error…
–
CVE-2006-4618
PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to…
–
CVE-2006-0806
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via…
–
CVE-2006-0410
SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary…
–
CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle,…