CVE-2007-5401

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files, related to not properly checking file extensions.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/27699Vendor Advisory
http://secunia.com/secunia_research/2007-94/advisory/Vendor Advisory
http://www.securityfocus.com/bid/27187
https://exchange.xforce.ibmcloud.com/vulnerabilities/39536
http://secunia.com/advisories/27699Vendor Advisory
http://secunia.com/secunia_research/2007-94/advisory/Vendor Advisory
http://www.securityfocus.com/bid/27187
https://exchange.xforce.ibmcloud.com/vulnerabilities/39536

Timeline

Published: Jan 9, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-54026.5Multiple SQL injection vulnerabilities in Layton HelpBox 3.7.1 allow (1) remote attackers to execute arbitrary SQL commands via the sys_requ CVE-2007-54033.5Multiple cross-site scripting (XSS) vulnerabilities in Layton HelpBox 3.7.1 allow remote authenticated users to inject arbitrary web script CVE-2007-54045.0Layton HelpBox 3.7.1 generates different responses depending on whether or not a username is valid in a failed login attempt, which allows r CVE-2007-54059.3Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used b CVE-2007-54069.3kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec M CVE-2007-54076.8Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers CVE-2007-54086.8SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category p CVE-2007-54096.8PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when register_globals is enabled CVE-2007-54106.8PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 componen CVE-2007-54114.3Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary we CVE-2007-54126.8Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass (com_mp3_allopass) 1.0 component for Joomla! allow remote at CVE-2007-54137.8httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Cli