My bugzilla installation is sending out spam

[jsporring]

Dear all,

It appears, that someone found a way to misuse Bugzilla v. 2.22.2 to spam the world: one user reported that he received the following:

<a href="http://www.opentissue.org/bugzilla/attachment.cgi?id=7"
rel="nofollow">http://www.opentissue.org/bugzilla/attachment.cgi?
id=7</a> <a href="http://www.opentissue.org/bugzilla/attachment.cgi?
id=7" rel="nofollow">wet pussy</a> [url=http://www.opentissue.org/
bugzilla/attachment.cgi?id=7]wet pussy[/url]<br>

What I think happened was, that an original non-spam bug-report and fix was followed up by spamming posts with attachments. The bug can be found safely at:

http://www.opentissue.org/bugzilla/show_bug.cgi?id=7

but when looking at the individual posts, then the browser is automatically redirected to a sex site.

Bugzilla doesn't allow me to delete or change posts, and I'm hesitant to enter MySQL to edit the posts directly. I've checked bugzillas.org, but have not found any help. Has anyone experience similar problems and found a fix?

Thanks, Jon