CVE-2012-4975

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

Design/Logic Flaw

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

CVE-2012-4975

CVE-2012-4975 affects Layton Helpbox 4.4.0. An authorization bypass exists on editrequestuser.asp: by changing the sys_request_id parameter, a remote authenticated attacker can access and modify other users’ support-ticket data, effectively logging in as another user and altering data. The descri...

CVE-2012-4975

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

CVE-2012-4975: Undefined Security Weakness

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sysrequestid parameter...

CVE-2007-5402: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow 1 remote attackers to execute arbitrary SQL commands via the sysrequestid parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via 2 the oldpassword parameter to...