Description
Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cacti | 0.8.6d-1 | — |
| Debian 14 | libphp-adodb | 4.72-0.1 | — |
| Debian 13 | cacti | 0.8.6d-1 | — |
| Debian 13 | libphp-adodb | 4.72-0.1 | — |
| Debian 12 | cacti | 0.8.6d-1 | — |
| Debian 12 | libphp-adodb | 4.72-0.1 | — |
| Debian 3.1 | cacti | 0.8.6c-7sarge3 | DSA-1031-1 |
| Debian 3.1 | libphp-adodb | 4.52-1sarge1 | DSA-1029-1 |
| Debian 3.1 | moodle | 1.4.4.dfsg.1-3sarge1 | DSA-1030-1 |
| Debian 3.0 | libphp-adodb | 1.51-1.2 | DSA-1029-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- ADOdb < 4.71 - Cross Site Scripting EDB-43832 · webapps · Feb 18, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- DSA-1029-1 libphp-adodb - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1030-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1031-1 cacti - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 19590 third-party-advisory
- 19555 third-party-advisory
- ADV-2006-0664 vdb-entry
- 452 third-party-advisory
- DSA-1029 vendor-advisory
- 18928 third-party-advisory
- DSA-1030 vendor-advisory
- http://www.gulftech.org/?node=research&article_id=00101-02182006
- 16720 vdb-entry
- 19591 third-party-advisory
- 20060218 ADOdb Library Cross Site Scripting mailing-list
- ADV-2006-2021 vdb-entry
- 19691 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=419843&group_id=8956
- DSA-1031 vendor-advisory
- http://phpesp.cvs.sourceforge.net/phpesp/phpESP/admin/include/lib/adodb/adodb-pager.inc.php?r1=1.1&r2=1.2
- 23362 vdb-entry
- GLSA-200604-07 vendor-advisory