CVE-2006-0147 Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya,....
HighCVSS 7.5
EPSS 13.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| john lim adodb | = 4.66 | No fix listed |
| john lim adodb | = 4.68 | No fix listed |
| mantis | = 0.19.4 | No fix listed |
| mantis | = 1.0.0_rc4 | No fix listed |
| moodle/moodle | = 1.5.3 | No fix listed |
| postnuke software foundation postnuke | = 0.761 | No fix listed |
| the cacti group cacti | = 0.8.6g | No fix listed |
| debian/cacti(Debian:12) | < 0.8.6d-1 | 0.8.6d-1 |
| debian/cacti(Debian:13) | < 0.8.6d-1 | 0.8.6d-1 |
| debian/cacti(Debian:14) | < 0.8.6d-1 | 0.8.6d-1 |
| debian/libphp-adodb(Debian:12) | < 4.72-0.1 | 4.72-0.1 |
| debian/libphp-adodb(Debian:13) | < 4.72-0.1 | 4.72-0.1 |
| debian/libphp-adodb(Debian:14) | < 4.72-0.1 | 4.72-0.1 |
References
- Debian Security Tracker CVE-2006-0147 vendor-advisory
- bugs.debian.org issue-tracking
- retrogod.altervista.org exploit
- retrogod.altervista.org exploit
- 17418 exploit patch third-party-advisory vendor-advisory
- 18233 patch third-party-advisory vendor-advisory
- 18254 patch third-party-advisory vendor-advisory
- 18260 patch third-party-advisory vendor-advisory
- 18267 third-party-advisory vendor-advisory
- 18276 patch third-party-advisory vendor-advisory
- 19555 patch third-party-advisory vendor-advisory
- 19590 patch third-party-advisory vendor-advisory
- 19591 patch third-party-advisory vendor-advisory
- 19600 third-party-advisory vendor-advisory
- 19628 patch third-party-advisory vendor-advisory
- 19691 third-party-advisory
- secunia.com exploit patch vendor-advisory
- DSA-1029 patch vendor-advisory
- DSA-1030 patch vendor-advisory
- DSA-1031 vendor-advisory
- GLSA-200604-07 patch vendor-advisory
- 22291 vdb-entry
- 20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection mailing-list
- 20060412 Simplog <=0.9.2 multiple vulnerabilities mailing-list
- ADV-2006-0101 vdb-entry
- ADV-2006-0102 vdb-entry
- ADV-2006-0103 vdb-entry
- ADV-2006-0104 vdb-entry
- ADV-2006-1305 vdb-entry
- ADV-2006-1332 vdb-entry
- adodb-tmssql-command-execution(24052) vdb-entry
- 1663 exploit