Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Published: 2004-12-31
Updated: 2017-07-11
Summary
Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comment_id parameter in editcommentenduser.asp, (2) the sys_suspend_id parameter in editsuspensionuser.asp, (3) the table parameter in export_data.asp, (4) the sys_analgroup parameter in manageanalgrouppreference.asp, (5) the sys_asset_id parameter in quickinfoassetrequests.asp, (6) the sys_eusername parameter in quickinfoenduserrequests.asp, and the sys_request_id parameter in (7) requestauditlog.asp, (8) requestcommentsenduser.asp, (9) selectrequestapplytemplate.asp, and (10) selectrequestlink.asp, resulting in an ability to create a new HelpBox user account and read, modify, or delete data from the backend database.
Vulnerable Configurations
Exploit-Db
| description | Layton Technology HelpBox 3.0.1 Multiple SQL Injection Vulnerabilities. CVE-2004-2551. Webapps exploit for php platform |
| id | EDB-ID:24303 |
| last seen | 2016-02-02 |
| modified | 2004-07-21 |
| published | 2004-07-21 |
| reporter | Noam Rathaus |
| source | https://www.exploit-db.com/download/24303/ |
| title | Layton Technology HelpBox 3.0.1 - Multiple SQL Injection Vulnerabilities |