Layton Helpbox 4.4.0 SQL Injection

Layton Helpbox 4.4.0 Multiple SQL Injection Points by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to multiple SQL injection vulnerabilities. CVE number: CVE-2012-4971 Impact: High Vendor homepage: http://www.laytontechnology.com Vendor notified:...

Layton Helpbox 4.4.0 Password Disclosure

Layton Helpbox 4.4.0 Password Disclosure Vulnerability by Joseph Sheridan Summary Layton Technologies Helpbox product version 4.4.0 is vulnerable to a password disclosure vulnerability in an error page. CVE number: CVE-2012-4976 Impact: High Vendor homepage: http://www.laytontechnology.com Vendor...

idev-MusicShop 2.0 Cross Site Request Forgery

Exploit Title: idev-MusicShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-musicshop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide...

idev-DigiMall 2.0 Cross Site Request Forgery

Exploit Title: idev-DigiMall 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digimall/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide...

idev-DigiVendor 5.0 Cross Site Request Forgery

Exploit Title: idev-DigiVendor 5.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digivendor/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide...

Sql injection

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

Code injection

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5401

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...

CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

Unrestricted file upload

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions...

CVE-2007-5403

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5404

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

CVE-2007-5403

Multiple cross-site scripting XSS vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 Forename, 2 Surname, 3 Telephone, and 4 Fax fields to writeenduserenduser.asp; the 5 Filter field to statsrequestypereport.asp; and the 6...

CVE-2007-5401

CVE-2007-5401 : Unrestricted file upload vulnerability in Layton HelpBox 3.7.1’s uploadrequest.asp allows remote attackers with authentication to upload and execute arbitrary ASP files due to improper validation of file extensions. The issue enables uploading executable server-side scripts and is...

CVE-2007-5404

Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows remote attackers to enumerate valid usernames...

CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...

CVE-2007-5403

CVE-2007-5403 affects Layton HelpBox 3.7.1 with multiple cross-site scripting (XSS) vulnerabilities. The issues allow remote injection of arbitrary script/HTML via various form fields (Forename, Surname, Telephone, Fax; Asset, Location, Problem Desc, Solution Desc; End User, Description) and para...

CVE-2007-5402

CVE-2007-5402 covers multiple SQL injection flaws in Layton HelpBox, affecting version 3.7.1 (and related references to 3.0.1) where an attacker could inject via parameters such as sys_request_id (editrequestenduser.asp, changerequeststatus.asp, editrequestuser.asp, requestcommentsuser.asp, usera...

CVE-2007-5404

Layton HelpBox 3.7.1 is affected by a username enumeration flaw: authentication responses differ for valid vs. invalid usernames during failed login, enabling remote attackers to determine valid usernames. The CVE description from NVD confirms the issue and impact is limited to credential enumera...