CVE-2006-0146
published 2006-01-09CVE-2006-0146: The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya…
PriorityP353high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
13.24%
95.9th percentile
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cacti | cacti | >= 0 < 0.8.6d-1 | 0.8.6d-1 |
| cacti | cacti | >= 0 < 0.8.6d-1 | 0.8.6d-1 |
| cacti | cacti | >= 0 < 0.8.6d-1 | 0.8.6d-1 |
| cacti | cacti | >= 0 < 0.8.6d-1 | 0.8.6d-1 |
| debian | cacti | < cacti 0.8.6d-1 (bookworm) | cacti 0.8.6d-1 (bookworm) |
| debian | libphp-adodb | < cacti 0.8.6d-1 (bookworm) | cacti 0.8.6d-1 (bookworm) |
| john_lim | adodb | — | — |
| john_lim | adodb | — | — |
| mantis | mantis | — | — |
| mantis | mantis | — | — |
| moodle | moodle | — | — |
| postnuke_software_foundation | postnuke | — | — |
| the_cacti_group | cacti | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q9q3-j7rw-3j95: The server
ghsa_unreviewed·2022-05-01
CVE-2006-0146 [HIGH] CWE-89 GHSA-q9q3-j7rw-3j95: The server
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
OSV
CVE-2006-0146: The server
osv·2006-01-09·CVSS 7.5
CVE-2006-0146 [HIGH] CVE-2006-0146: The server
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Debian
CVE-2006-0146: cacti - The server.php test script in ADOdb for PHP before 4.70, as used in multiple pro...
vendor_debian·2006·CVSS 7.5
CVE-2006-0146 [HIGH] CVE-2006-0146: cacti - The server.php test script in ADOdb for PHP before 4.70, as used in multiple pro...
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Scope: local
bookworm: resolved (fixed in 0.8.6d-1)
bullseye: resolved (fixed in 0.8.6d-1)
forky: resolved (fixed in 0.8.6d-1)
sid: resolved (fixed in 0.8.6d-1)
trixie: resolved (fixed in 0.8.6d-1)
No detection rules found.
No writeups or analysis indexed.
http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlhttp://secunia.com/advisories/17418http://secunia.com/advisories/18233http://secunia.com/advisories/18254http://secunia.com/advisories/18260http://secunia.com/advisories/18267http://secunia.com/advisories/18276http://secunia.com/advisories/18720http://secunia.com/advisories/19555http://secunia.com/advisories/19563http://secunia.com/advisories/19590http://secunia.com/advisories/19591http://secunia.com/advisories/19600http://secunia.com/advisories/19691http://secunia.com/advisories/19699http://secunia.com/advisories/24954http://secunia.com/secunia_research/2005-64/advisory/http://securityreason.com/securityalert/713http://www.debian.org/security/2006/dsa-1029http://www.debian.org/security/2006/dsa-1030http://www.debian.org/security/2006/dsa-1031http://www.gentoo.org/security/en/glsa/glsa-200604-07.xmlhttp://www.maxdev.com/Article550.phtmlhttp://www.osvdb.org/22290http://www.securityfocus.com/archive/1/423784/100/0/threadedhttp://www.securityfocus.com/archive/1/430448/100/0/threadedhttp://www.securityfocus.com/archive/1/466171/100/0/threadedhttp://www.securityfocus.com/bid/16187http://www.vupen.com/english/advisories/2006/0101http://www.vupen.com/english/advisories/2006/0102http://www.vupen.com/english/advisories/2006/0103http://www.vupen.com/english/advisories/2006/0104http://www.vupen.com/english/advisories/2006/0105http://www.vupen.com/english/advisories/2006/0370http://www.vupen.com/english/advisories/2006/0447http://www.vupen.com/english/advisories/2006/1304http://www.vupen.com/english/advisories/2006/1305http://www.vupen.com/english/advisories/2006/1419http://www.xaraya.com/index.php/news/569https://exchange.xforce.ibmcloud.com/vulnerabilities/24051http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlhttp://secunia.com/advisories/17418http://secunia.com/advisories/18233http://secunia.com/advisories/18254http://secunia.com/advisories/18260http://secunia.com/advisories/18267http://secunia.com/advisories/18276http://secunia.com/advisories/18720http://secunia.com/advisories/19555http://secunia.com/advisories/19563http://secunia.com/advisories/19590http://secunia.com/advisories/19591http://secunia.com/advisories/19600http://secunia.com/advisories/19691http://secunia.com/advisories/19699http://secunia.com/advisories/24954http://secunia.com/secunia_research/2005-64/advisory/http://securityreason.com/securityalert/713http://www.debian.org/security/2006/dsa-1029http://www.debian.org/security/2006/dsa-1030http://www.debian.org/security/2006/dsa-1031http://www.gentoo.org/security/en/glsa/glsa-200604-07.xmlhttp://www.maxdev.com/Article550.phtmlhttp://www.osvdb.org/22290http://www.securityfocus.com/archive/1/423784/100/0/threadedhttp://www.securityfocus.com/archive/1/430448/100/0/threadedhttp://www.securityfocus.com/archive/1/466171/100/0/threadedhttp://www.securityfocus.com/bid/16187http://www.vupen.com/english/advisories/2006/0101http://www.vupen.com/english/advisories/2006/0102http://www.vupen.com/english/advisories/2006/0103http://www.vupen.com/english/advisories/2006/0104http://www.vupen.com/english/advisories/2006/0105http://www.vupen.com/english/advisories/2006/0370http://www.vupen.com/english/advisories/2006/0447http://www.vupen.com/english/advisories/2006/1304http://www.vupen.com/english/advisories/2006/1305http://www.vupen.com/english/advisories/2006/1419http://www.xaraya.com/index.php/news/569https://exchange.xforce.ibmcloud.com/vulnerabilities/24051
2006-01-09
Published