CVE-2006-0146: john_lim adodb SQL Injection

CVSS: 7.5v2.0HighModified

AliasesDEBIAN-CVE-2006-0146

Published 09-01-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-0146 is a high (CVSS 7.5) SQL Injection vulnerability in john_lim adodb. EPSS estimates a 13.24% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

43/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

13.24%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits6reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 3

DSA-1029-1 DSA-1030-1 DSA-1031-1

Timeline

09-01-2006
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

13.24%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.24% on 19-09-2026

19-09-202619-10-2026

EPSS score

13.24%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

6 found

referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
referenceUnverified
Exploit Reference (secunia.com)
Maturity: unknown

Show all 6 exploits

referenceUnverified
Exploit Reference (osvdb.org)
Maturity: unknown
referenceUnverified
Exploit Reference (retrogod.altervista.org)
Maturity: unknown
exploit-databasephpVerified
Simplog 0.9.2 - 's' Remote Command Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Debian2 products

cacti< 0.8.6d-1
libphp-adodb< 4.72-0.1

John_lim1 product

adodb4.66 | 4.68

Mantis1 product

mantis0.19.4 | 1.0.0_rc4

Moodle1 product

moodle1.5.3

Postnuke_software_foundation1 product

postnuke0.761

The_cacti_group1 product

cacti0.8.6g

6 vendors · 7 products

References

41 links

secunia.com/advisories/19590Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/18267Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/18254Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/19555Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.debian.org/security/2006/dsa-1029Vendor AdvisoryX Refsource DEBIANPatch
www.securityfocus.com/archive/1/430448/100/0/threadedMailing ListX Refsource BUGTRAQ
www.maxdev.com/Article550.phtmlX Refsource CONFIRMURL Repurposed
www.vupen.com/english/advisories/2006/0105VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/19699Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.debian.org/security/2006/dsa-1030Vendor AdvisoryX Refsource DEBIANPatch

Show all 41 references

www.vupen.com/english/advisories/2006/1305VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/24954Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/18276Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
securityreason.com/securityalert/713Third Party AdvisoryX Refsource SREASON
www.vupen.com/english/advisories/2006/1304VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/19600Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/466171/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2006/0103VDB EntryX Refsource VUPENVendor Advisory
secunia.com/secunia_research/2005-64/advisory/X Refsource MISCExploitPatchVendor Advisory
www.securityfocus.com/bid/16187VDB EntryX Refsource BIDExploitPatch
secunia.com/advisories/18720Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.vupen.com/english/advisories/2006/1419VDB EntryX Refsource VUPEN
secunia.com/advisories/19591Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.vupen.com/english/advisories/2006/0447VDB EntryX Refsource VUPENVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/24051VDB EntryX Refsource XF
secunia.com/advisories/17418Third Party AdvisoryX Refsource SECUNIAExploitPatchVendor Advisory
www.xaraya.com/index.php/news/569X Refsource CONFIRMPatch
secunia.com/advisories/19691Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2006/0102VDB EntryX Refsource VUPEN
www.vupen.com/english/advisories/2006/0101VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/18233Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.osvdb.org/22290VDB EntryX Refsource OSVDBExploitPatch
www.vupen.com/english/advisories/2006/0370VDB EntryX Refsource VUPENVendor Advisory
www.debian.org/security/2006/dsa-1031Vendor AdvisoryX Refsource DEBIANPatch
retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlX Refsource MISCExploit
www.securityfocus.com/archive/1/423784/100/0/threadedMailing ListX Refsource BUGTRAQ
www.vupen.com/english/advisories/2006/0104VDB EntryX Refsource VUPENVendor Advisory
secunia.com/advisories/18260Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
www.gentoo.org/security/en/glsa/glsa-200604-07.xmlVendor AdvisoryX Refsource GENTOOPatch
secunia.com/advisories/19563Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
security-tracker.debian.org/tracker/CVE-2006-0146Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities