CVE-2006-0146
Fixed in a distro release EPSS 13%
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Products: john_lim adodb, mantis, mediabeez, moodle, postnuke_software_foundation postnuke, the_cacti_group cacti
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cacti | 0.8.6d-1 |
| Debian 12 | libphp-adodb | 4.72-0.1 |
| Debian 13 | cacti | 0.8.6d-1 |
| Debian 13 | libphp-adodb | 4.72-0.1 |
| Debian 14 | cacti | 0.8.6d-1 |
| Debian 14 | libphp-adodb | 4.72-0.1 |
| Debian 3.0 | libphp-adodb | 1.51-1.2 |
| Debian 3.1 | cacti | 0.8.6c-7sarge3 |
| Debian 3.1 | libphp-adodb | 4.52-1sarge1 |
| Debian 3.1 | moodle | 1.4.4.dfsg.1-3sarge1 |