CVE-2007-5402

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.93%

Published

Jan 9, 2008

Modified

Jun 16, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_request_id parameter to editrequestenduser.asp; and allow remote authenticated users to execute arbitrary SQL commands via (2) the oldpassword parameter to writepwdenduser.asp, and the sys_request_id parameter to (3) changerequeststatus.asp, (4) editrequestuser.asp, (5) requestcommentsuser.asp, and (6) useractions.asp, different vectors than CVE-2004-2551.

Weaknesses (CWE)

CWE-89

Affected Products (1)

layton_technology · helpboxvulnerable

References (10)

http://secunia.com/advisories/27699

Vendor Advisory

http://secunia.com/secunia_research/2007-94/advisory/

Vendor Advisory

http://www.securityfocus.com/bid/27187

https://exchange.xforce.ibmcloud.com/vulnerabilities/39538

https://exchange.xforce.ibmcloud.com/vulnerabilities/39539

http://secunia.com/advisories/27699

Vendor Advisory

http://secunia.com/secunia_research/2007-94/advisory/

KEV Catalog EPSS Scores Vendors All CVEs