HelpBox Multiple Security Vulnerabilities
BID:27187
Info
HelpBox Multiple Security Vulnerabilities
| Bugtraq ID: | 27187 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-5401 CVE-2007-5402 CVE-2007-5403 CVE-2007-5404 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 08 2008 12:00AM |
| Updated: | Jan 10 2008 06:09PM |
| Credit: | Secunia Research is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
Layton Technology HelpBox 3.7.1 |
| Not Vulnerable: | |
Discussion
HelpBox Multiple Security Vulnerabilities
HelpBox is prone to multiple security vulnerabilities because the application fails to properly sanitize user-supplied input.
These vulnerabilities include an arbitrary-file-upload issue, multiple SQL-injection issues, multiple HTML-injection issues, and a weakness that enables attackers to identify the presence of valid user accounts.
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
These issues affect HelpBox 3.7.1; other versions may also be affected.
HelpBox is prone to multiple security vulnerabilities because the application fails to properly sanitize user-supplied input.
These vulnerabilities include an arbitrary-file-upload issue, multiple SQL-injection issues, multiple HTML-injection issues, and a weakness that enables attackers to identify the presence of valid user accounts.
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
These issues affect HelpBox 3.7.1; other versions may also be affected.
Exploit / POC
HelpBox Multiple Security Vulnerabilities
Attackers can exploit these issues through a browser.
Attackers can exploit these issues through a browser.
Solution / Fix
HelpBox Multiple Security Vulnerabilities
Solution:
According to the vendor, these issues will be fixed in an upcoming release of HelpBox 4.0.
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
According to the vendor, these issues will be fixed in an upcoming release of HelpBox 4.0.
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
HelpBox Multiple Security Vulnerabilities
References:
References:
- HelpBox Homepage (Layton Technologies)
- Layton HelpBox Multiple Vulnerabilities (Secunia Research)