CVE-2006-0147
NoneCVSS
—
EPSS
13.1%
Published
Jan 9, 2006
CISA due date
—
The record
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | cacti | 0 | 0.8.6d-1 |
| Debian:10 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:11 | cacti | 0 | 0.8.6d-1 |
| Debian:11 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:12 | cacti | 0 | 0.8.6d-1 |
| Debian:12 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:13 | cacti | 0 | 0.8.6d-1 |
| Debian:13 | libphp-adodb | 0 | 4.72-0.1 |
| Debian:3.0 | libphp-adodb | 0 | 1.51-1.2 |
| Debian:3.1 | cacti | 0 | 0.8.6c-7sarge3 |
| Debian:3.1 | libphp-adodb | 0 | 4.52-1sarge1 |
| Debian:3.1 | moodle | 0 | 1.4.4.dfsg.1-3sarge1 |
Related vulnerabilities
- CVE-2009-4112 Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by… Also affects cacti
- CVE-2006-0146 The server.php test script in ADOdb for PHP before 4.70, as used in multiple products… Also affects cacti
- CVE-2005-1526 PHP remote file inclusion vulnerability in config_settings.php in Cacti before 0.8.6e… Also affects cacti
- CVE-2005-1524 PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly… Also affects cacti
- CVE-2016-4855 Cross-site scripting vulnerability in ADOdb versions prior to 5.20.6 allows remote… Also affects libphp-adodb
- CVE-2025-24367 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-54146 Cacti is an open source performance and fault management framework. Also affects cacti
- CVE-2024-48910 DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Also affects cacti