PT-2008-1483 · Layton · Layton Helpbox

Published 2008-01-09 · Updated 2017-07-29 · CVE-2007-5403

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Layton HelpBox version 3.7.1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via several fields, including Forename, Surname, Telephone, Fax, Filter, sys request id, Asset, Location, Problem, Asset Location, Problem Desc, Solution Desc, End User, and Description. These fields are used in various ASP pages, such as writeenduserenduser.asp, statsrequestypereport.asp, requestattach.asp, editrequestenduser.asp, editrequestuser.asp, and usersearchrequests.asp. Note that exploitation of vectors related to the Filter field and the sys request id parameter does not require authentication.

Recommendations For Layton HelpBox version 3.7.1, consider validating and sanitizing user input for the Forename, Surname, Telephone, Fax, Filter, sys request id, Asset, Location, Problem, Asset Location, Problem Desc, Solution Desc, End User, and Description fields to prevent injection of arbitrary web script or HTML. As a temporary workaround, restrict access to the affected ASP pages until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5403

Affected Products

Layton Helpbox

References · 9

• http://secunia.com/secunia_research/2007-94/advisory · Vendor Advisory
• http://secunia.com/advisories/27699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5403 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39541 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39542 · Note
• http://securityfocus.com/bid/27187 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39537 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39543 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39540 · Note