high7.5Public exploit code

CVE-2006-0146

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Simplog 0.9.2 - 's' Remote Command Execution2006-04-11 · webapps · php · Verified

Impact

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.

Affected products

Vendor	Product	Affected versions
John Lim	Adodb	Versions 4.66, 4.68
Mantis	Mantis	Versions 0.19.4, 1.0.0_rc4
Mediabeez	Mediabeez	All versions
Moodle	Moodle	Version 1.5.3
Postnuke Software Foundation	Postnuke	Version 0.761
The Cacti Group	Cacti	Version 0.8.6g

Weakness classification

CWE-89

Public exploit code

Impact

Affected products

Weakness classification

References