Explain CVE-2006-0146
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Affected Products: n/a
References: [{'name': '19590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19590'}, {'name': '18267', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18267'}, {'name': '18254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18254'}, {'name': '19555', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19555'}, {'name': 'DSA-1029', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1029'}, {'name': '20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430448/100/0/threaded'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.maxdev.com/Article550.phtml'}, {'name': 'ADV-2006-0105', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0105'}, {'name': '19699', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19699'}, {'name': 'DSA-1030', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1030'}, {'name': 'ADV-2006-1305', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1305'}, {'name': '24954', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/24954'}, {'name': '18276', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18276'}, {'name': '713', 'tags': ['third-party-advisory', 'x_refsource_SREASON'], 'url': 'http://securityreason.com/securityalert/713'}, {'name': 'ADV-2006-1304', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1304'}, {'name': '19600', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19600'}, {'name': "20070418 MediaBeez Sql query Execution .. Wear isn't ?? :)", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/466171/100/0/threaded'}, {'name': 'ADV-2006-0103', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0103'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2005-64/advisory/'}, {'name': '16187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/16187'}, {'name': '18720', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18720'}, {'name': 'ADV-2006-1419', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1419'}, {'name': '19591', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19591'}, {'name': 'ADV-2006-0447', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0447'}, {'name': 'adodb-server-command-execution(24051)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24051'}, {'name': '17418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/17418'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.xaraya.com/index.php/news/569'}, {'name': '19691', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19691'}, {'name': 'ADV-2006-0102', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0102'}, {'name': 'ADV-2006-0101', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0101'}, {'name': '18233', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18233'}, {'name': '22290', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22290'}, {'name': 'ADV-2006-0370', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0370'}, {'name': 'DSA-1031', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1031'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html'}, {'name': '20060202 Bug for libs in php link directory 2.0', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/423784/100/0/threaded'}, {'name': 'ADV-2006-0104', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0104'}, {'name': '18260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18260'}, {'name': 'GLSA-200604-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml'}, {'name': '19563', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19563'}]
CVE State: PUBLISHED