CVE-2006-0147

2006-01-0923:03:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve

code evaluation

vulnerability

adodb

php

remote execution

arbitrary functions

security

7.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.027 Low

EPSS

Percentile

90.4%

JSON

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.

CPENameOperatorVersion
postnuke_software_foundation:postnukepostnuke software foundation postnukeeq0.761
john_lim:adodbjohn lim adodbeq4.66
the_cacti_group:cactithe cacti group cactieq0.8.6g
mantis:mantismantiseq1.0.0_rc4
john_lim:adodbjohn lim adodbeq4.68
moodle:moodlemoodleeq1.5.3
mantis:mantismantiseq0.19.4

CPE	Name	Operator	Version
postnuke_software_foundation:postnuke	postnuke software foundation postnuke	eq	0.761
john_lim:adodb	john lim adodb	eq	4.66
the_cacti_group:cacti	the cacti group cacti	eq	0.8.6g
mantis:mantis	mantis	eq	1.0.0_rc4
john_lim:adodb	john lim adodb	eq	4.68
moodle:moodle	moodle	eq	1.5.3
mantis:mantis	mantis	eq	0.19.4