CVE-2007-5402 - CVE House
Back to Database
Status published Medium CVE-2007-5402

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1)...

Vulnerability Description

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via (2) the oldpassword parameter to writepwdenduser.asp, and the sys_request_id parameter to (3) changerequeststatus.asp, (4) editrequestuser.asp, (5) requestcommentsuser.asp, and (6) useractions.asp, different vectors than CVE-2004-2551.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-5402

Credits & Attribution

No credits recorded in the NVD database.

References

More from layton technology

View All →
CVE-2012-4977
Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials...
Medium 5
CVE-2012-4976
selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover...
Medium 5
CVE-2012-4975
editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to...
Medium 4
CVE-2012-4972
Multiple cross-site scripting (XSS) vulnerabilities in Layton Helpbox 4.4.0 allow...
Medium 4.3
CVE-2012-4971
Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote...
High 7.5

Affected Vendor

layton technology

View all reports →

Affected Software

helpbox
Vulnerable Versions:
3.7.1

Timeline

Official Publish: January 9th, 2008
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.