CVE-2006-0146

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-01-09 · updated 2026-06-16
Weakness: CWE-89

Description

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.

Affected products

John Lim Adodb: 4.66, 4.68
mantis: 0.19.4, 1.0.0_rc4
Mediabeez: all versions
Moodle: 1.5.3
Postnuke Software Foundation Postnuke: 0.761
The Cacti Group Cacti: 0.8.6g

References

http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
http://secunia.com/advisories/17418
http://secunia.com/advisories/18233
http://secunia.com/advisories/18254
http://secunia.com/advisories/18260
http://secunia.com/advisories/18267
http://secunia.com/advisories/18276
http://secunia.com/advisories/18720
http://secunia.com/advisories/19555
http://secunia.com/advisories/19563
http://secunia.com/advisories/19590
http://secunia.com/advisories/19591

Get alerted when CVE-2006-0146 or the next vulnerability affects your stack