CVE-2006-0146: The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis,...

Security readout for executives and security teams

This flaw affected old PHP applications bundling ADOdb before 4.70. If the exposed ADOdb server.php test script was reachable and the MySQL root password was empty, a remote attacker could run arbitrary SQL against the database. The business risk is serious for legacy internet-facing systems, but exposure depends on a weak database configuration and a leftover test script. Most likely exposure is legacy PHP software from the affected era with bundled ADOdb, reachable server.php test files, and an empty MySQL root password. Modern maintained installs are less likely exposed, but old forgotten web roots, backups, or unmanaged applications remain plausible. Prioritize if any legacy PHP application remains internet-facing or unmanaged. The issue is old, but the impact can be database-level compromise when the documented conditions exist. Treat it as a legacy exposure cleanup item rather than a current KEV-driven emergency. Mitigation focus: Upgrade ADOdb to version 4.70 or later where directly managed.; Apply product-specific vendor or distribution fixes for bundled ADOdb copies.; Remove or block public access to ADOdb test scripts such as server.php..

Prepared

Jun 29, 2026, 15:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.