CVE-2006-0147
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8)…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 13.06% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- john lim/adodb · mantis/mantis · moodle/moodle · postnuke software foundation/postnuke · the cacti group/cacti
- Source
- cve@mitre.org
References
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.htmlExploit
- http://retrogod.altervista.org/simplog_092_incl_xpl.htmlExploit
- http://secunia.com/advisories/17418Exploit, Patch, Vendor Advisory
- http://secunia.com/advisories/18233Patch, Vendor Advisory
- http://secunia.com/advisories/18254Patch, Vendor Advisory
- http://secunia.com/advisories/18260Patch, Vendor Advisory
- http://secunia.com/advisories/18267Vendor Advisory
- http://secunia.com/advisories/18276Patch, Vendor Advisory
- http://secunia.com/advisories/19555Patch, Vendor Advisory
- http://secunia.com/advisories/19590Patch, Vendor Advisory
- http://secunia.com/advisories/19591Patch, Vendor Advisory
- http://secunia.com/advisories/19600Vendor Advisory
- http://secunia.com/advisories/19628Patch, Vendor Advisory
- http://secunia.com/advisories/19691
- http://secunia.com/secunia_research/2005-64/advisory/Exploit, Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1029Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1030Patch, Vendor Advisory
- http://www.debian.org/security/2006/dsa-1031
- http://www.gentoo.org/security/en/glsa/glsa-200604-07.xmlPatch, Vendor Advisory
- http://www.osvdb.org/22291
- http://www.securityfocus.com/archive/1/430448/100/0/threaded
- http://www.securityfocus.com/archive/1/430743/100/0/threaded
- http://www.vupen.com/english/advisories/2006/0101
- http://www.vupen.com/english/advisories/2006/0102
- http://www.vupen.com/english/advisories/2006/0103
- http://www.vupen.com/english/advisories/2006/0104
- http://www.vupen.com/english/advisories/2006/1305
- http://www.vupen.com/english/advisories/2006/1332
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24052
- https://www.exploit-db.com/exploits/1663
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.