Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
About the Team
Disclosure Policy
SVCRP

Secunia Research: Layton HelpBox Multiple Vulnerabilities

======================================================================

                     Secunia Research 08/01/2008

             - Layton HelpBox Multiple Vulnerabilities -

======================================================================
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

======================================================================
1) Affected Software

Layton HelpBox 3.7.1

NOTE: Other versions may also be affected.

======================================================================
2) Severity

Rating: Moderately Critical
Impact: System access
        Exposure of sensitive information
        Manipulation of data
        Cross-site scripting
Where:  Remote

======================================================================
3) Vendor's Description of Software

"HelpBox is a helpdesk solution that assists in managing all incoming
service requests and support calls. HelpBox helps assign these
requests and calls to different resources according to priority,
problem type and technical skills. This helps companies resolve
problems faster. HelpBox expedites workflows by improving
communication and efficiency in regards to client and internal
technical support. Since HelpBox is Web-based, it can be accessed
anywhere anytime."

Product Link:
http://www.laytontechnology.com/pages/helpbox.asp

======================================================================
4) Description of Vulnerability

Secunia Research has discovered some vulnerabilities and a weakness
in Layton HelpBox, which can be exploited by malicious users to
conduct script insertion and SQL injection attacks and compromise a
vulnerable system, and by malicious people to identify valid user
accounts and conduct cross-site scripting, script insertion, and
SQL injection attacks.

1) Improper checks of file extensions in uploadrequest.asp can be
exploited to upload arbitrary files. This can e.g. be exploited to
upload and execute arbitrary ASP code on a vulnerable system.

Successful exploitation of this vulnerability requires valid user
credentials.

2) Input passed to the "sys_request_id" parameter in
editrequestenduser.asp is not properly sanitised before being used in
SQL queries. This can be exploited to manipulate SQL queries by
injecting arbitrary SQL code.

3) Input passed to the "oldpassword" parameter in writepwdenduser.asp
is not properly sanitised before being used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL
code.

Successful exploitation of this vulnerability requires valid user
credentials.

4) Input passed to the "sys_request_id" parameter in
changerequeststatus.asp, editrequestuser.asp, requestcommentsuser.asp,
and useractions.asp is not properly sanitised before being used in SQL
queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Successful exploitation of these vulnerabilities require valid analyst
credentials.

5) Input passed to the "Asset", "Location", and "Problem" form fields
in editrequestenduser.asp is not properly sanitised before being
stored. This can be exploited to insert arbitrary HTML and script code,
which is executed in a user's browser session in context of an affected
site when the malicious data is viewed.

Successful exploitation requires that both the attacker and the target
user have valid user credentials.

6) Input passed to the "Forename", "Surname", "Telephone", and "Fax"
form fields in writeenduserenduser.asp is not properly sanitised before
being stored. This can be exploited to insert arbitrary HTML and script
code, which is executed in a user's browser session in context of an
affected site when the malicious data is viewed.

Successful exploitation requires that the target user has valid user
credentials.

7) Input passed to the "Asset", "Asset Location", "Problem Desc", and
"Solution Desc" form fields in editrequestuser.asp is not properly
sanitised before being stored. This can be exploited to insert
arbitrary HTML and script code, which is executed in a user's browser
session in context of an affected site when the malicious data is
viewed.

Successful exploitation of this vulnerability requires valid analyst
credentials.

8) Input passed to the "Filter" form field in statsrequestypereport.asp
and the "sys_request_id" parameter in requestattach.asp is not properly
sanitised before being returned to the user. This can be exploited to
execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

9) Input passed to the "End User" and "Description" form fields in
usersearchrequests.asp is not properly sanitised before being returned
to the user. This can be exploited to execute arbitrary HTML and 
script code in a user's browser session in context of an affected 
site.

Successful exploitation of this vulnerability requires that the target
user has analyst credentials.

10) Different error messages are returned depending on whether an
unsuccessful login attempt is performed with a valid or invalid
username.

======================================================================
5) Solution

According to the vendor, the vulnerabilities should be fixed in a 
upcoming version 4.0.

======================================================================
6) Time Table

20/11/2007 - Vendor notified.
21/11/2007 - Vendor reply
29/11/2007 - Vendor contacted for status update.
04/12/2007 - Vendor reply
04/12/2007 - Vendor contacted again.
05/12/2007 - Vendor reply.
08/01/2008 - Public disclosure.

======================================================================
7) Credits

Discovered by Secunia Research.

======================================================================
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned the
following CVE identifiers:
* CVE-2007-5401 (file upload)
* CVE-2007-5402 (SQL injection)
* CVE-2007-5403 (XSS/script insertion)
* CVE-2007-5404 (user enumeration)

======================================================================
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://corporate.secunia.com/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private
individuals, who are interested in or concerned about IT-security.

http://secunia.com/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the
security and reliability of software in general:

http://corporate.secunia.com/secunia_research/33/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/secunia_vacancies/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

======================================================================
10) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2007-94/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================




 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability