CVE-2006-0146

CVSS V2 High 7.5 CVSS V3 None
Description
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Overview
  • CVE ID
  • CVE-2006-0146
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2006-01-09T23:03:00
  • Last Modified Date
  • 2018-10-19T15:42:50
Weakness Enumerations
CWE URL
CWE-89 http://cwe.mitre.org/data/definitions/89.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:john_lim:adodb:4.66:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:john_lim:adodb:4.68:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mantis:mantis:0.19.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mantis:mantis:1.0.0_rc4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:mediabeez:mediabeez:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:moodle:moodle:1.5.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.761:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:the_cacti_group:cacti:0.8.6g:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 7.5
  • Severity
  • HIGH
  • Exploitability Score
  • 10
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
http://secunia.com/secunia_research/2005-64/advisory/ Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/16187 Exploit Patch
http://secunia.com/advisories/17418 Exploit Patch Vendor Advisory
http://secunia.com/advisories/18254 Vendor Advisory
http://secunia.com/advisories/18267 Vendor Advisory
http://secunia.com/advisories/18260 Patch Vendor Advisory
http://secunia.com/advisories/18276 Patch Vendor Advisory
http://secunia.com/advisories/18233 Patch Vendor Advisory
http://www.osvdb.org/22290 Exploit Patch
http://secunia.com/advisories/18720 Patch Vendor Advisory
http://www.xaraya.com/index.php/news/569 Patch
http://www.debian.org/security/2006/dsa-1029 Patch Vendor Advisory
http://www.debian.org/security/2006/dsa-1030 Patch Vendor Advisory
http://www.debian.org/security/2006/dsa-1031 Patch Vendor Advisory
http://secunia.com/advisories/19555 Patch Vendor Advisory
http://secunia.com/advisories/19590 Patch Vendor Advisory
http://secunia.com/advisories/19591 Patch Vendor Advisory
http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html Exploit
http://www.maxdev.com/Article550.phtml
http://secunia.com/advisories/19563 Patch Vendor Advisory
http://secunia.com/advisories/19600 Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml Patch Vendor Advisory
http://secunia.com/advisories/19699 Patch Vendor Advisory
http://secunia.com/advisories/19691 Vendor Advisory
http://secunia.com/advisories/24954 Vendor Advisory
http://securityreason.com/securityalert/713
http://www.vupen.com/english/advisories/2006/1305 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0447 Vendor Advisory
http://www.vupen.com/english/advisories/2006/1419
http://www.vupen.com/english/advisories/2006/0104 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0370 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0102
http://www.vupen.com/english/advisories/2006/1304 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0105 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0103 Vendor Advisory
http://www.vupen.com/english/advisories/2006/0101 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/24051
http://www.securityfocus.com/archive/1/466171/100/0/threaded
http://www.securityfocus.com/archive/1/430448/100/0/threaded
http://www.securityfocus.com/archive/1/423784/100/0/threaded
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2006-0146
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0146
History
Created Old Value New Value Data Type Notes
2022-05-10 18:03:57 Added to TrackCVE