Description
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.6d-1 | — |
| Debian 14 | libphp-adodb | 4.72-0.1 | — |
| Debian 13 | cacti | 0.8.6d-1 | — |
| Debian 13 | libphp-adodb | 4.72-0.1 | — |
| Debian 12 | cacti | 0.8.6d-1 | — |
| Debian 12 | libphp-adodb | 4.72-0.1 | — |
| Debian 3.1 | cacti | 0.8.6c-7sarge3 | DSA-1031-1 |
| Debian 3.1 | libphp-adodb | 4.52-1sarge1 | DSA-1029-1 |
| Debian 3.1 | moodle | 1.4.4.dfsg.1-3sarge1 | DSA-1030-1 |
| Debian 3.0 | libphp-adodb | 1.51-1.2 | DSA-1029-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Simplog 0.9.2 - 's' Remote Command Execution EDB-1663 · webapps · Apr 11, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1029-1 libphp-adodb - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1030-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1031-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 19590 third-party-advisory
- 18267 third-party-advisory
- 18254 third-party-advisory
- 19555 third-party-advisory
- DSA-1029 vendor-advisory
- 20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection mailing-list
- http://www.maxdev.com/Article550.phtml
- ADV-2006-0105 vdb-entry
- 19699 third-party-advisory
- DSA-1030 vendor-advisory
- ADV-2006-1305 vdb-entry
- 24954 third-party-advisory
- 18276 third-party-advisory
- 713 third-party-advisory
- ADV-2006-1304 vdb-entry
- 19600 third-party-advisory
- 20070418 MediaBeez Sql query Execution .. Wear isn't ?? :) mailing-list
- ADV-2006-0103 vdb-entry
- http://secunia.com/secunia_research/2005-64/advisory/
- 16187 vdb-entry
- 18720 third-party-advisory
- ADV-2006-1419 vdb-entry
- 19591 third-party-advisory
- ADV-2006-0447 vdb-entry
- adodb-server-command-execution(24051) vdb-entry
- 17418 third-party-advisory
- http://www.xaraya.com/index.php/news/569
- 19691 third-party-advisory
- ADV-2006-0102 vdb-entry
- ADV-2006-0101 vdb-entry
- 18233 third-party-advisory
- 22290 vdb-entry
- ADV-2006-0370 vdb-entry
- DSA-1031 vendor-advisory
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
- 20060202 Bug for libs in php link directory 2.0 mailing-list
- ADV-2006-0104 vdb-entry
- 18260 third-party-advisory
- GLSA-200604-07 vendor-advisory
- 19563 third-party-advisory