Vulnerability Details CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.084
EPSS Ranking 91.8%
CVSS Severity
CVSS v2 Score 7.5
References
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
- http://secunia.com/advisories/17418
- http://secunia.com/advisories/18233
- http://secunia.com/advisories/18254
- http://secunia.com/advisories/18260
- http://secunia.com/advisories/18267
- http://secunia.com/advisories/18276
- http://secunia.com/advisories/18720
- http://secunia.com/advisories/19555
- http://secunia.com/advisories/19563
- http://secunia.com/advisories/19590
- http://secunia.com/advisories/19591
- http://secunia.com/advisories/19600
- http://secunia.com/advisories/19691
- http://secunia.com/advisories/19699
- http://secunia.com/advisories/24954
- http://secunia.com/secunia_research/2005-64/advisory/
- http://securityreason.com/securityalert/713
- http://www.debian.org/security/2006/dsa-1029
- http://www.debian.org/security/2006/dsa-1030
- http://www.debian.org/security/2006/dsa-1031
- http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml
- http://www.maxdev.com/Article550.phtml
- http://www.osvdb.org/22290
- http://www.securityfocus.com/archive/1/423784/100/0/threaded
- http://www.securityfocus.com/archive/1/430448/100/0/threaded
- http://www.securityfocus.com/archive/1/466171/100/0/threaded
- http://www.securityfocus.com/bid/16187
- http://www.vupen.com/english/advisories/2006/0101
- http://www.vupen.com/english/advisories/2006/0102
- http://www.vupen.com/english/advisories/2006/0103
- http://www.vupen.com/english/advisories/2006/0104
- http://www.vupen.com/english/advisories/2006/0105
- http://www.vupen.com/english/advisories/2006/0370
- http://www.vupen.com/english/advisories/2006/0447
- http://www.vupen.com/english/advisories/2006/1304
- http://www.vupen.com/english/advisories/2006/1305
- http://www.vupen.com/english/advisories/2006/1419
- http://www.xaraya.com/index.php/news/569
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24051
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
- http://secunia.com/advisories/17418
- http://secunia.com/advisories/18233
- http://secunia.com/advisories/18254
- http://secunia.com/advisories/18260
- http://secunia.com/advisories/18267
- http://secunia.com/advisories/18276
- http://secunia.com/advisories/18720
- http://secunia.com/advisories/19555
- http://secunia.com/advisories/19563
- http://secunia.com/advisories/19590
- http://secunia.com/advisories/19591
- http://secunia.com/advisories/19600
- http://secunia.com/advisories/19691
- http://secunia.com/advisories/19699
- http://secunia.com/advisories/24954
- http://secunia.com/secunia_research/2005-64/advisory/
- http://securityreason.com/securityalert/713
- http://www.debian.org/security/2006/dsa-1029
- http://www.debian.org/security/2006/dsa-1030
- http://www.debian.org/security/2006/dsa-1031
- http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml
- http://www.maxdev.com/Article550.phtml
- http://www.osvdb.org/22290
- http://www.securityfocus.com/archive/1/423784/100/0/threaded
- http://www.securityfocus.com/archive/1/430448/100/0/threaded
- http://www.securityfocus.com/archive/1/466171/100/0/threaded
- http://www.securityfocus.com/bid/16187
- http://www.vupen.com/english/advisories/2006/0101
- http://www.vupen.com/english/advisories/2006/0102
- http://www.vupen.com/english/advisories/2006/0103
- http://www.vupen.com/english/advisories/2006/0104
- http://www.vupen.com/english/advisories/2006/0105
- http://www.vupen.com/english/advisories/2006/0370
- http://www.vupen.com/english/advisories/2006/0447
- http://www.vupen.com/english/advisories/2006/1304
- http://www.vupen.com/english/advisories/2006/1305
- http://www.vupen.com/english/advisories/2006/1419
- http://www.xaraya.com/index.php/news/569
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24051
Products affected by CVE-2006-0146
-
cpe:2.3:a:john_lim:adodb:4.66
-
cpe:2.3:a:john_lim:adodb:4.68
-
cpe:2.3:a:mantis:mantis:0.19.4
-
cpe:2.3:a:mantis:mantis:1.0.0_rc4
-
cpe:2.3:a:mediabeez:mediabeez:*
-
cpe:2.3:a:moodle:moodle:1.5.3
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.761
-
cpe:2.3:a:the_cacti_group:cacti:0.8.6g