CVE-2007-5402

Layton HelpBox 3.7.1 - SQL Injection via sys_request_id Parameter

Title source: llm
STIX 2.1

Description

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via (2) the oldpassword parameter to writepwdenduser.asp, and the sys_request_id parameter to (3) changerequeststatus.asp, (4) editrequestuser.asp, (5) requestcommentsuser.asp, and (6) useractions.asp, different vectors than CVE-2004-2551.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/39539
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/39538
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27699
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/27187

Scores

EPSS 0.0093
EPSS Percentile 57.2%

Details

CWE
CWE-89
Status published
Products (1)
layton_technology/helpbox 3.7.1
Published Jan 09, 2008
Tracked Since Feb 18, 2026