Description
Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack.
References
- bugzilla-email-sql-injection(10235) vdb-entry
- http://bugzilla.mozilla.org/show_bug.cgi?id=165221
- 5842 vdb-entry
- 20021001 [BUGZILLA] Security Advisory mailing-list