CVE Vulnerability

CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via (2) the oldpassword parameter to writepwdenduser.asp, and the sys_request_id parameter to (3) changerequeststatus.asp, (4) editrequestuser.asp, (5) requestcommentsuser.asp, and (6) useractions.asp, different vectors than CVE-2004-2551.

6.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

References
Link Resource
http://secunia.com/secunia_research/2007-94/advisory/ Vendor Advisory
http://www.securityfocus.com/bid/27187
http://secunia.com/advisories/27699 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/39539
https://exchange.xforce.ibmcloud.com/vulnerabilities/39538
Configurations

Configuration 1

cpe:2.3:a:layton_technology:helpbox:3.7.1:*:*:*:*:*:*:*
Information

Published : 2008-01-09 09:46

Updated : 2017-07-29 01:33

NVD link : CVE-2007-5402

Mitre link : CVE-2007-5402

Products Affected
No products.
CWE
CWE-89