CVE-2002-0811

An attacker sends a crafted HTTP request to `buglist.cgi` with a malicious `order` parameter containing SQL injection payloads (e.g., UNION subqueries in MySQL 4). The parameter is inserted directly into the SQL ORDER BY clause without sanitization, allowing the attacker to execute arbitrary SQL or cause a denial of service. The advisory notes that MySQL 4's UNION support makes this exploitable for data extraction, while PostgreSQL's syntax limits it to sorting manipulation [ref_id=1].

The vulnerability is in `buglist.cgi`, where the `order` parameter is passed directly into SQL queries without validation. The fix adds a validation loop that checks each sort column fragment against a strict identifier regex (`[A-Za-z_][0-9A-Za-z_]*\.[A-Za-z_][0-9A-Za-z_]*`) and rejects invalid column names with an error message [ref_id=1].

The patch adds a validation loop in `buglist.cgi` that splits the `order` parameter on commas/whitespace and checks each fragment against a strict identifier regex (`[A-Za-z_][0-9A-Za-z_]*\.[A-Za-z_][0-9A-Za-z_]*`). Fragments that do not match (e.g., containing SQL keywords, spaces, or subqueries) cause an error message and exit, preventing injection. The fix also clears the `LASTORDER` cookie if it contains an invalid sort order [ref_id=1].