ADOdb contains a flaw that may allow an attacker to carry out an SQL injection attack. The issue is due to the server.php script not properly sanitizing user-supplied input to the 'sql' variable. This may allow an attacker to inject or manipulate SQL queries in the back-end database.

Upgrade to version 4.70 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Bugtraq ID: 16187
• Milw0rm: 1663
• Exploit Database: 1663
• Secunia Advisory ID: 17418 18233 18254 18260 18267 18276 18720 18732 19555 19563 19590 19591 19600 19691 19699 24954
• CVE ID: 2006-0146 (see also: NVD)
• Related OSVDB ID: 22291
• VUPEN Advisory: ADV-2006-0101 ADV-2006-0102 ADV-2006-0103 ADV-2006-0104 ADV-2006-0105
• Vendor URL: http://adodb.sourceforge.net/
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2006-02/0020.html
  http://archives.neohapsis.com/archives/bugtraq/2006-04/0183.html
  http://archives.neohapsis.com/archives/bugtraq/2007-04/0312.html
  http://archives.neohapsis.com/archives/fulldisclosure/2006-01/0300.html
• Vendor Specific News/Changelog Entry: http://docs.moodle.org/en/Release_Notes#Moodle_1.5.4
  http://sourceforge.net/project/shownotes.php?release_id=383910&group_id=42718
  http://www.maxdev.com/Article550.phtml
  http://www.phplinkdirectory.com/forum/viewtopic.php?t=1668
• Vendor Specific Advisory URL: http://news.postnuke.com/Article2747.html
  http://www.us.debian.org/security/2006/dsa-1029
  http://www.us.debian.org/security/2006/dsa-1030
  http://www.us.debian.org/security/2006/dsa-1031
• Packet Storm: http://packetstormsecurity.org/0601-advisories/sa17418.txt
• Other Advisory URL: http://retrogod.altervista.org/phpopenchat_30x_sql_xpl.html
  http://www.gentoo.org/security/en/glsa/glsa-200604-07.xml

• Andreas Sandblad - assecunia.com - Secunia Research