CVE-2006-0147

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-01-09 · updated 2026-06-16

Description

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.

Affected products

John Lim Adodb: 4.66, 4.68
mantis: 0.19.4, 1.0.0_rc4
Moodle: 1.5.3
Postnuke Software Foundation Postnuke: 0.761
The Cacti Group Cacti: 0.8.6g

References

http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
http://retrogod.altervista.org/simplog_092_incl_xpl.html
http://secunia.com/advisories/17418
http://secunia.com/advisories/18233
http://secunia.com/advisories/18254
http://secunia.com/advisories/18260
http://secunia.com/advisories/18267
http://secunia.com/advisories/18276
http://secunia.com/advisories/19555
http://secunia.com/advisories/19590
http://secunia.com/advisories/19591
http://secunia.com/advisories/19600

Get alerted when CVE-2006-0147 or the next vulnerability affects your stack