Explain CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Affected Products: n/a
References: [{'name': '19590', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19590'}, {'name': '18267', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18267'}, {'name': '18254', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18254'}, {'name': '19555', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19555'}, {'name': 'DSA-1029', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1029'}, {'name': 'adodb-tmssql-command-execution(24052)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/24052'}, {'name': '19628', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19628'}, {'name': '20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430448/100/0/threaded'}, {'name': 'DSA-1030', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1030'}, {'name': 'ADV-2006-1305', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1305'}, {'name': '18276', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18276'}, {'name': '19600', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19600'}, {'name': '1663', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/1663'}, {'name': 'ADV-2006-0103', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0103'}, {'tags': ['x_refsource_MISC'], 'url': 'http://secunia.com/secunia_research/2005-64/advisory/'}, {'name': '20060412 Simplog <=0.9.2 multiple vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/430743/100/0/threaded'}, {'name': '19591', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19591'}, {'name': '17418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/17418'}, {'name': '19691', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19691'}, {'name': 'ADV-2006-0102', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0102'}, {'name': 'ADV-2006-0101', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0101'}, {'name': '18233', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18233'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/simplog_092_incl_xpl.html'}, {'name': 'ADV-2006-1332', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1332'}, {'name': '22291', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/22291'}, {'name': 'DSA-1031', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2006/dsa-1031'}, {'tags': ['x_refsource_MISC'], 'url': 'http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html'}, {'name': 'ADV-2006-0104', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/0104'}, {'name': '18260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/18260'}, {'name': 'GLSA-200604-07', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml'}]
CVE State: PUBLISHED