PT-2006-1227 · Phpopenchat+8 · Phpopenchat+8

Rgod · Published 2006-01-09 · Updated 2018-10-19 · CVE-2006-0147

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ADODB versions prior to 4.70 Mantis versions prior to the version that updates ADOdb to 4.70 PostNuke versions prior to the version that updates ADOdb to 4.70 Moodle versions prior to the version that updates ADOdb to 4.70 Cacti versions prior to the version that updates ADOdb to 4.70 Xaraya versions prior to the version that updates ADOdb to 4.70 PhpOpenChat versions prior to the version that updates ADOdb to 4.70 MAXdev MD-Pro versions prior to the version that updates ADOdb to 4.70 Simplog versions prior to the version that updates ADOdb to 4.70

Description A dynamic code evaluation issue exists in the tests/tmssql.php test script in ADOdb for PHP, which is used by multiple products. This issue allows remote attackers to execute arbitrary PHP functions via the do parameter. The do parameter is saved in a variable that is then executed as a function, enabling the execution of arbitrary PHP code. An example of exploitation is demonstrated using phpinfo.

Recommendations Update ADOdb to version 4.70 or later. Update Mantis to a version that includes ADOdb 4.70 or later. Update PostNuke to a version that includes ADOdb 4.70 or later. Update Moodle to a version that includes ADOdb 4.70 or later. Update Cacti to a version that includes ADOdb 4.70 or later. Update Xaraya to a version that includes ADOdb 4.70 or later. Update PhpOpenChat to a version that includes ADOdb 4.70 or later. Update MAXdev MD-Pro to a version that includes ADOdb 4.70 or later. Update Simplog to a version that includes ADOdb 4.70 or later.

Exploit

Fix

Related Identifiers

CVE-2006-0147

DSA-1029-1

DSA-1030-1

DSA-1031-1

Affected Products

Adodb

Cacti

Maxdev Md-Pro

Mantis

Moodle

Phpopenchat

Postnuke

Simplog

Xaraya

References · 35

• 🔥 http://retrogod.altervista.org/simplog_092_incl_xpl.html · Exploit
• 🔥 http://secunia.com/secunia_research/2005-64/advisory · Exploit
• 🔥 https://exploit-db.com/exploits/1663 · Exploit
• 🔥 http://secunia.com/advisories/17418 · Exploit
• 🔥 http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html · Exploit
• http://secunia.com/advisories/19628 · Vendor Advisory
• http://secunia.com/advisories/18233 · Vendor Advisory
• http://secunia.com/advisories/19590 · Vendor Advisory
• http://debian.org/security/2006/dsa-1030 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200604-07.xml · Vendor Advisory
• http://secunia.com/advisories/19600 · Vendor Advisory
• http://secunia.com/advisories/18260 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-0147 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-0147 · Vendor Advisory
• http://secunia.com/advisories/18267 · Vendor Advisory