CVE-2006-0146: John Lim Adodb

High severity, CVSS 7.5. EPSS: 13.2% chance of exploitation in the next 30 days.

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.

Affected products

• John Lim Adodb: version 4.66 only; version 4.68 only
• Mantis Mantis: version 0.19.4 only; version 1.0.0_rc4 only
• Mediabeez Mediabeez: any version
• Moodle Moodle: version 1.5.3 only
• Postnuke Software Foundation Postnuke: version 0.761 only
• The Cacti Group Cacti: version 0.8.6g only

Published 2006-01-09. Last modified 2026-06-16.