Description
SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL commands via the whinedays parameter, as accessible from editparams.cgi.
References
- bugzilla-editparams-sql-injection(24819) vdb-entry
- 18979 third-party-advisory
- ADV-2006-0692 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=312498
- 20060221 [BUGZILLA] Security Advisory for Bugzilla 2.20, 2.21.1, and 2.18.4 mailing-list
- 16738 vdb-entry
- 23378 vdb-entry