CVE-2012-4975 editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys_request_id parameter.

MediumCVSS 4.0 EPSS 0.84%

Published: 2012-12-12 13:00
Updated: 2026-06-17 02:45
Exploit status: No public exploit known

Description

editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys_request_id parameter.

Affected products

Product	Affected versions	Fixed in
layton technology helpbox	= 4.4.0	No fix listed

References

www.reactionpenetrationtesting.co.uk
helpbox-security-bypass(79644) vdb-entry

CVSS v2.0

4.0 Medium

AV:N/AC:L/Au:S/C:N/I:P/A:N

Access Vector: Network
Access Complexity: Low
Authentication: Single
Confidentiality: None
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.84% (percentile 58.4)
CWE: CWE-264

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.