CVE-2012-4971: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 reqclass parameter to editrequestenduser.asp; the 2 sysrequestid parameter to editrequestuser.asp; the 3 sysrequestid parameter to enduseractions.asp; the 4 sysrequest...

CVE-2012-4975: Undefined Security Weakness

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

Layton Helpbox 4.4.0 Multiple Security Issues

Layton Helpbox 4.4.0 Multiple Security Issues: Layton Helpbox 4.4.0 Multiple SQL Injection Points CVE-2012-4971 http://www.reactionpenetrationtesting.co.uk/helpbox-sql-injection.html Layton Helpbox 4.4.0 Authorisation Bypass Vulnerability CVE-2012-4975...

Sql injection

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5401

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...

CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

Code injection

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

Unrestricted file upload

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...

CVE-2007-5403

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5404

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

CVE-2007-5403

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5401

CVE-2007-5401 : Unrestricted file upload vulnerability in Layton HelpBox 3.7.1’s uploadrequest.asp allows remote attackers with authentication to upload and execute arbitrary ASP files due to improper validation of file extensions. The issue enables uploading executable server-side scripts and is...

CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

CVE-2007-5404

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

CVE-2007-5403

CVE-2007-5403 affects Layton HelpBox 3.7.1 with multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote injection of arbitrary script/HTML via various form fields (Forename, Surname, Telephone, Fax; Asset, Location, Problem Desc, Solution Desc; End User, Description) and para...

CVE-2007-5402

CVE-2007-5402 covers multiple SQL injection flaws in Layton HelpBox, affecting version 3.7.1 (and related references to 3.0.1) where an attacker could inject via parameters such as sys_request_id (editrequestenduser.asp, changerequeststatus.asp, editrequestuser.asp, requestcommentsuser.asp, usera...

CVE-2007-5404

Layton HelpBox 3.7.1 is affected by a username enumeration flaw: authentication responses differ for valid vs. invalid usernames during failed login, enabling remote attackers to determine valid usernames. The CVE description from NVD confirms the issue and impact is limited to credential enumera...

CVE-2007-5402: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

CVE-2007-5401: Undefined Security Weakness

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...