CVE-2002-0010

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via 1 the sql parameter in buglist.cgi, 2 invalid field names from the "boolean chart" query in buglist.cgi, 3 the mybugslink parameter in userprefs.cgi, 4 a malformed bug ID in the...

CVE-2002-0010

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via 1 the sql parameter in buglist.cgi, 2 invalid field names from the "boolean chart" query in buglist.cgi, 3 the mybugslink parameter in userprefs.cgi, 4 a malformed bug ID in the...

CVE-2002-0010

Bugzilla prior to 2.14.1 contains multiple input handling flaws that enable remote SQL injection and file creation, potentially elevating privileges. Specifically, via: (1) sql parameter in buglist.cgi, (2) invalid field names in the boolean chart query in buglist.cgi, (3) mybugslink parameter in...