CVE-2006-0146 in the critical feed json
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) C…
published 2006-01-09 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0154
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.2%
- EPSS 13.2% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Patch / fix
- cacti Debian 14, Debian 13, Debian 12 0.8.6d-1
- libphp-adodb Debian 14, Debian 13, Debian 12 4.72-0.1
debian advisories DEBIAN-CVE-2006-0146
- securityfocus.com/bid/16187 patch
- xaraya.com/index.php/news/569 patch
- osvdb.org/22290 patch
- debian.org/security/2006/dsa-1029 advisory
- debian.org/security/2006/dsa-1030 advisory
- debian.org/security/2006/dsa-1031 advisory
- gentoo.org/security/en/glsa/glsa-200604-07.xml advisory
- secunia.com/advisories/19590 advisory
- secunia.com/advisories/19555 advisory
- secunia.com/advisories/19699 advisory
Timeline
- Published
- First public exploit (EDB-1663)
Exploit prediction
13.24% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1663 Simplog 0.9.2 - 's' Remote Command Execution webapps, 2006-04-11
- secunia.com http://secunia.com/secunia_research/2005-64/advisory/ referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/16187 referenced PoC, tagged "exploit" by a source, unverified
- secunia.com http://secunia.com/advisories/17418 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/22290 referenced PoC, tagged "exploit" by a source, unverified
- retrogod.altervista.org http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
debian.org
/security/2006/dsa-1029
vendor-advisory, patch
-
debian.org
/security/2006/dsa-1030
vendor-advisory, patch
-
debian.org
/security/2006/dsa-1031
vendor-advisory, patch
-
gentoo.org
/security/en/glsa/glsa-200604-07.xml
vendor-advisory, patch
-
secunia.com
/advisories/19590
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/19555
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/19699
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/18276
third-party-advisory, patch, vendor-advisory
-
secunia.com
/secunia_research/2005-64/advisory/
exploit, patch, vendor-advisory
-
securityfocus.com
/bid/16187
vdb-entry, exploit, patch
-
secunia.com
/advisories/18720
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/19591
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/17418
third-party-advisory, exploit, patch, vendor-advisory
-
xaraya.com
/index.php/news/569
patch
-
secunia.com
/advisories/18233
third-party-advisory, patch, vendor-advisory
-
osvdb.org
/22290
vdb-entry, exploit, patch
-
secunia.com
/advisories/18260
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/19563
third-party-advisory, patch, vendor-advisory
-
retrogod.altervista.org
/phpopenchat_30x_sql_xpl.html
exploit
-
secunia.com
/advisories/18267
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/18254
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/0105
vdb-entry, vendor-advisory
-
vupen.com
/english/advisories/2006/1305
vdb-entry, vendor-advisory
-
secunia.com
/advisories/24954
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/1304
vdb-entry, vendor-advisory
-
secunia.com
/advisories/19600
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/0103
vdb-entry, vendor-advisory
-
vupen.com
/english/advisories/2006/0447
vdb-entry, vendor-advisory
-
secunia.com
/advisories/19691
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/0101
vdb-entry, vendor-advisory
-
vupen.com
/english/advisories/2006/0370
vdb-entry, vendor-advisory
-
vupen.com
/english/advisories/2006/0104
vdb-entry, vendor-advisory
-
securityfocus.com
/archive/1/430448/100/0/threaded
mailing-list
-
maxdev.com
/Article550.phtml
url-repurposed
-
securityreason.com
/securityalert/713
third-party-advisory
-
securityfocus.com
/archive/1/466171/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2006/1419
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24051
vdb-entry
-
vupen.com
/english/advisories/2006/0102
vdb-entry
-
securityfocus.com
/archive/1/423784/100/0/threaded
mailing-list
Sources
- CVE List CVE-2006-0146
- NVD CVE-2006-0146
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.