CVE-2006-0147: John Lim Adodb

High severity, CVSS 7.5. EPSS: 13.1% chance of exploitation in the next 30 days.

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.

Affected products

• John Lim Adodb: version 4.66 only; version 4.68 only
• Mantis Mantis: version 0.19.4 only; version 1.0.0_rc4 only
• Moodle Moodle: version 1.5.3 only
• Postnuke Software Foundation Postnuke: version 0.761 only
• The Cacti Group Cacti: version 0.8.6g only

Published 2006-01-09. Last modified 2026-06-16.