Description
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.6d-1 | — |
| Debian 14 | libphp-adodb | 4.72-0.1 | — |
| Debian 13 | cacti | 0.8.6d-1 | — |
| Debian 13 | libphp-adodb | 4.72-0.1 | — |
| Debian 12 | cacti | 0.8.6d-1 | — |
| Debian 12 | libphp-adodb | 4.72-0.1 | — |
| Debian 3.1 | cacti | 0.8.6c-7sarge3 | DSA-1031-1 |
| Debian 3.1 | libphp-adodb | 4.52-1sarge1 | DSA-1029-1 |
| Debian 3.1 | moodle | 1.4.4.dfsg.1-3sarge1 | DSA-1030-1 |
| Debian 3.0 | libphp-adodb | 1.51-1.2 | DSA-1029-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Simplog 0.9.2 - 's' Remote Command Execution EDB-1663 · webapps · Apr 11, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1029-1 libphp-adodb - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1030-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1031-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 19590 third-party-advisory
- 18267 third-party-advisory
- 18254 third-party-advisory
- 19555 third-party-advisory
- DSA-1029 vendor-advisory
- adodb-tmssql-command-execution(24052) vdb-entry
- 19628 third-party-advisory
- 20060409 PhpOpenChat 3.0.x ADODB Server.php "sql" SQL injection mailing-list
- DSA-1030 vendor-advisory
- ADV-2006-1305 vdb-entry
- 18276 third-party-advisory
- 19600 third-party-advisory
- 1663 exploit
- ADV-2006-0103 vdb-entry
- http://secunia.com/secunia_research/2005-64/advisory/
- 20060412 Simplog <=0.9.2 multiple vulnerabilities mailing-list
- 19591 third-party-advisory
- 17418 third-party-advisory
- 19691 third-party-advisory
- ADV-2006-0102 vdb-entry
- ADV-2006-0101 vdb-entry
- 18233 third-party-advisory
- http://retrogod.altervista.org/simplog_092_incl_xpl.html
- ADV-2006-1332 vdb-entry
- 22291 vdb-entry
- DSA-1031 vendor-advisory
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
- ADV-2006-0104 vdb-entry
- 18260 third-party-advisory
- GLSA-200604-07 vendor-advisory