CVE-2006-0146
NoneCVSS
—
EPSS
13.2%
Published
Jan 9, 2006
CISA due date
—
The record
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | cacti | 0 | 0.8.6d-1 |
| Debian:10 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:11 | cacti | 0 | 0.8.6d-1 |
| Debian:11 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:12 | cacti | 0 | 0.8.6d-1 |
| Debian:12 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:13 | cacti | 0 | 0.8.6d-1 |
| Debian:13 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:3.0 | libphp-adodb | 0 | 1.51-1.2 |
| Debian:3.1 | cacti | 0 | 0.8.6c-7sarge3 |
| Debian:3.1 | libphp-adodb | 0 | 4.52-1sarge1 |
| Debian:3.1 | moodle | 0 | 1.4.4.dfsg.1-3sarge1 |
Related vulnerabilities
- CVE-2009-4112 Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by… Also affects cacti
- CVE-2006-0147 Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP… Also affects cacti
- CVE-2005-1526 PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e… Also affects cacti
- CVE-2005-1524 PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly… Also affects cacti
- CVE-2016-4855 Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote… Also affects libphp-adodb
- CVE-2025-24367 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-54146 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-48910 DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Also affects cacti