BID:16738

Bugzilla Whinedays SQL Injection Vulnerability

Info

Bugzilla Whinedays SQL Injection Vulnerability

Bugtraq ID:	16738
Class:	Input Validation Error
CVE:	CVE-2006-0915 CVE-2006-0913
Remote:	Yes
Local:	No
Published:	Feb 21 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	Frédéric Buclin is credited with the discovery of this vulnerability.
Vulnerable:	Mozilla Bugzilla 2.21.1 Mozilla Bugzilla 2.21 Mozilla Bugzilla 2.20 rc2 Mozilla Bugzilla 2.20 rc1 Mozilla Bugzilla 2.19.3 Mozilla Bugzilla 2.19.2 Mozilla Bugzilla 2.19.1 Mozilla Bugzilla 2.19 Mozilla Bugzilla 2.18.4 Mozilla Bugzilla 2.18.3 Mozilla Bugzilla 2.18.2 Mozilla Bugzilla 2.18.1 Mozilla Bugzilla 2.18 rc3 Mozilla Bugzilla 2.18 rc2 Mozilla Bugzilla 2.18 rc1 Mozilla Bugzilla 2.17.7 Mozilla Bugzilla 2.17.6 Mozilla Bugzilla 2.17.5 Mozilla Bugzilla 2.17.4 Mozilla Bugzilla 2.17.3 Mozilla Bugzilla 2.17.1 Mozilla Bugzilla 2.20

Not Vulnerable:	Mozilla Bugzilla 2.21.2 Mozilla Bugzilla 2.20.1 Mozilla Bugzilla 2.18.5 Mozilla Bugzilla 2.22 RC1

Discussion

Bugzilla Whinedays SQL Injection Vulnerability

Bugzilla is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Exploitation of this issue requires the attacker to have administrative access to the affected application.

Exploit / POC

Bugzilla Whinedays SQL Injection Vulnerability

An exploit is not required.

Solution / Fix

Bugzilla Whinedays SQL Injection Vulnerability

Solution:

The vendor has released updates to address this issue. Please the referenced vendor advisory for further information.

Mozilla Bugzilla 2.20