CVE-2003-1042: SQL Injection

Published Jun 3, 2004

Updated

SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.

Affected Software

18 affected components

Bugzilla=2.16.1

Bugzilla=2.16.2

Bugzilla=2.17.4

Bugzilla=2.10

Bugzilla=2.17.1

Bugzilla=2.16

Bugzilla=2.14.2

Bugzilla=2.14.3

Bugzilla=2.14.4

Bugzilla=2.12

Bugzilla=2.6

Bugzilla=2.8

Bugzilla=2.14

Bugzilla=2.14.1

Bugzilla=2.16.3

Bugzilla=2.14.5

Bugzilla=2.4

Bugzilla=2.17.3

Remediation

Patch Available

http://www.securityfocus.com/bid/8953

Event History

Jun 3, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-1042?

CVE-2003-1042 is classified as a critical severity vulnerability due to the potential for remote authenticated users to execute arbitrary SQL commands.

How do I fix CVE-2003-1042?

To fix CVE-2003-1042, upgrade Bugzilla to version 2.16.4 or later where the vulnerability has been patched.

What versions of Bugzilla are affected by CVE-2003-1042?

CVE-2003-1042 affects Bugzilla versions 2.10, 2.12, 2.14.x, 2.16.1, 2.16.2, 2.16.3, and 2.17.1 through 2.17.4.

Who can exploit the CVE-2003-1042 vulnerability?

CVE-2003-1042 can be exploited by remote authenticated users who have editproducts privileges in Bugzilla.

What kind of attack can CVE-2003-1042 lead to?

CVE-2003-1042 can lead to SQL injection attacks, allowing attackers to manipulate the database.