Vulnerabilities > CVE-2006-0147 - Remote Security vulnerability in Moodle
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL network
low complexity
john-lim
mantis
moodle
postnuke-software-foundation
the-cacti-group
nessus
exploit available
Summary
Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 | |
| Application | 2 | |
| Application | 1 | |
| Application | 1 | |
| Application | 1 |
Exploit-Db
| description | Simplog <= 0.9.2 (s) Remote Commands Execution Exploit. CVE-2006-0146,CVE-2006-0147,CVE-2006-1776,CVE-2006-1777,CVE-2006-1778,CVE-2006-1779,CVE-2006-2029.... |
| file | exploits/php/webapps/1663.php |
| id | EDB-ID:1663 |
| last seen | 2016-01-31 |
| modified | 2006-04-11 |
| platform | php |
| port | |
| published | 2006-04-11 |
| reporter | rgod |
| source | https://www.exploit-db.com/download/1663/ |
| title | Simplog <= 0.9.2 s Remote Commands Execution Exploit |
| type | webapps |
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1031.NASL description Several vulnerabilities have been discovered in libphp-adodb, the last seen 2020-06-01 modified 2020-06-02 plugin id 22573 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22573 title Debian DSA-1031-1 : cacti - several vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1030.NASL description Several vulnerabilities have been discovered in libphp-adodb, the last seen 2020-06-01 modified 2020-06-02 plugin id 22572 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22572 title Debian DSA-1030-1 : moodle - several vulnerabilities NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200604-07.NASL description The remote host is affected by the vulnerability described in GLSA-200604-07 (Cacti: Multiple vulnerabilities in included ADOdb) Several vulnerabilities have been identified in the copy of ADOdb included in Cacti. Andreas Sandblad discovered a dynamic code evaluation vulnerability (CVE-2006-0147) and a potential SQL injection vulnerability (CVE-2006-0146). Andy Staudacher reported another SQL injection vulnerability (CVE-2006-0410), and Gulftech Security discovered multiple cross-site-scripting issues (CVE-2006-0806). Impact : Remote attackers could trigger these vulnerabilities by sending malicious queries to the Cacti web application, resulting in arbitrary code execution, database compromise through arbitrary SQL execution, and malicious HTML or JavaScript code injection. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 21231 published 2006-04-17 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21231 title GLSA-200604-07 : Cacti: Multiple vulnerabilities in included ADOdb NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1029.NASL description Several vulnerabilities have been discovered in libphp-adodb, the last seen 2020-06-01 modified 2020-06-02 plugin id 22571 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22571 title Debian DSA-1029-1 : libphp-adodb - several vulnerabilities NASL family CGI abuses NASL id ADODB_DO_CMD_EXECUTION.NASL description The remote host is running ADOdb, a database abstraction library for PHP. The installed version of ADOdb includes a test script named last seen 2020-06-01 modified 2020-06-02 plugin id 20384 published 2006-01-10 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20384 title ADOdb tmssql.php do Parameter Arbitrary PHP Function Execution
References
- http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
- http://retrogod.altervista.org/simplog_092_incl_xpl.html
- http://secunia.com/advisories/17418
- http://secunia.com/advisories/18233
- http://secunia.com/advisories/18254
- http://secunia.com/advisories/18260
- http://secunia.com/advisories/18267
- http://secunia.com/advisories/18276
- http://secunia.com/advisories/19555
- http://secunia.com/advisories/19590
- http://secunia.com/advisories/19591
- http://secunia.com/advisories/19600
- http://secunia.com/advisories/19628
- http://secunia.com/advisories/19691
- http://secunia.com/secunia_research/2005-64/advisory/
- http://www.debian.org/security/2006/dsa-1029
- http://www.debian.org/security/2006/dsa-1030
- http://www.debian.org/security/2006/dsa-1031
- http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml
- http://www.osvdb.org/22291
- http://www.securityfocus.com/archive/1/430448/100/0/threaded
- http://www.securityfocus.com/archive/1/430743/100/0/threaded
- http://www.vupen.com/english/advisories/2006/0101
- http://www.vupen.com/english/advisories/2006/0102
- http://www.vupen.com/english/advisories/2006/0103
- http://www.vupen.com/english/advisories/2006/0104
- http://www.vupen.com/english/advisories/2006/1305
- http://www.vupen.com/english/advisories/2006/1332
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24052
- https://www.exploit-db.com/exploits/1663