Description
SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.6d-1 | — |
| Debian 14 | libphp-adodb | 4.72-0.1 | — |
| Debian 13 | cacti | 0.8.6d-1 | — |
| Debian 13 | libphp-adodb | 4.72-0.1 | — |
| Debian 12 | cacti | 0.8.6d-1 | — |
| Debian 12 | libphp-adodb | 4.72-0.1 | — |
| Debian 3.1 | cacti | 0.8.6c-7sarge3 | DSA-1031-1 |
| Debian 3.1 | libphp-adodb | 4.52-1sarge1 | DSA-1029-1 |
| Debian 3.1 | moodle | 1.4.4.dfsg.1-3sarge1 | DSA-1030-1 |
| Debian 3.0 | libphp-adodb | 1.51-1.2 | DSA-1029-1 |
Advisories 3
- DSA-1029-1 libphp-adodb - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1030-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1031-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 19590 third-party-advisory
- 19555 third-party-advisory
- DSA-1029 vendor-advisory
- ADV-2006-0448 vdb-entry
- DSA-1030 vendor-advisory
- ADV-2006-0315 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=387862&group_id=42718
- 18575 third-party-advisory
- 19591 third-party-advisory
- 18745 third-party-advisory
- adodb-postgresql-sql-injection(24314) vdb-entry
- 19691 third-party-advisory
- DSA-1031 vendor-advisory
- 22705 vdb-entry
- GLSA-200604-07 vendor-advisory
- 16364 vdb-entry
- 18732 third-party-advisory
- GLSA-200602-02 vendor-advisory