CVE - CVE-2004-2551

CVE-ID
CVE-2004-2551	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Multiple SQL injection vulnerabilities in Layton HelpBox 3.0.1 allow remote attackers to execute arbitrary SQL commands via (1) the sys_comment_id parameter in editcommentenduser.asp, (2) the sys_suspend_id parameter in editsuspensionuser.asp, (3) the table parameter in export_data.asp, (4) the sys_analgroup parameter in manageanalgrouppreference.asp, (5) the sys_asset_id parameter in quickinfoassetrequests.asp, (6) the sys_eusername parameter in quickinfoenduserrequests.asp, and the sys_request_id parameter in (7) requestauditlog.asp, (8) requestcommentsenduser.asp, (9) selectrequestapplytemplate.asp, and (10) selectrequestlink.asp, resulting in an ability to create a new HelpBox user account and read, modify, or delete data from the backend database.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:10776 URL:http://www.securityfocus.com/bid/10776 MISC:http://www.securiteam.com/windowsntfocus/5VP0S0ADFW.html OSVDB:8170 URL:~~http://www.osvdb.org/8170~~ (Obsolete source) OSVDB:8171 URL:~~http://www.osvdb.org/8171~~ (Obsolete source) OSVDB:8172 URL:~~http://www.osvdb.org/8172~~ (Obsolete source) OSVDB:8173 URL:~~http://www.osvdb.org/8173~~ (Obsolete source) OSVDB:8174 URL:~~http://www.osvdb.org/8174~~ (Obsolete source) OSVDB:8175 URL:~~http://www.osvdb.org/8175~~ (Obsolete source) OSVDB:8176 URL:~~http://www.osvdb.org/8176~~ (Obsolete source) OSVDB:8177 URL:~~http://www.osvdb.org/8177~~ (Obsolete source) OSVDB:8178 URL:~~http://www.osvdb.org/8178~~ (Obsolete source) OSVDB:8179 URL:~~http://www.osvdb.org/8179~~ (Obsolete source) SECUNIA:12118 URL:http://secunia.com/advisories/12118 XF:helpbox-multiple-sql-injection(16772) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/16772 XF:helpbox-url-gain-access(16774) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/16774
Assigning CNA
MITRE Corporation
Date Record Created
20051121	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20051121)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)