PT-2008-1483 · Layton · Layton Helpbox

Publicado

2008-01-09

·

Atualizado

2017-07-29

·

CVE-2007-5403

CVSS v2.0

3.5

Baixa

VetorAV:N/AC:M/Au:S/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Layton HelpBox version 3.7.1
Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several fields, including Forename, Surname, Telephone, Fax, Filter, sys request id, Asset, Location, Problem, Asset Location, Problem Desc, Solution Desc, End User, and Description. These fields are used in various ASP pages, such as writeenduserenduser.asp, statsrequestypereport.asp, requestattach.asp, editrequestenduser.asp, editrequestuser.asp, and usersearchrequests.asp. Note that exploitation of vectors related to the Filter field and the sys request id parameter does not require authentication.
Recommendations For Layton HelpBox version 3.7.1, consider validating and sanitizing user input for the Forename, Surname, Telephone, Fax, Filter, sys request id, Asset, Location, Problem, Asset Location, Problem Desc, Solution Desc, End User, and Description fields to prevent injection of arbitrary web script or HTML. As a temporary workaround, restrict access to the affected ASP pages until a patch is available.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5403

Produtos afetados

Layton Helpbox