CVE:CVE-2004-2562
CNNVD:CNNVD-200412-680
LBE Web Helpdesk是一款可通过WEB浏览器进行操作的Helpdesk系统。
LBE Web Helpdesk不正确过滤用户提交的数据，远程攻击者可以利用这个漏洞进行SQL注入攻击，可能获得敏感数据或修改数据库。
问题存在于jobedit.asp脚本对用户提交给'id'参数缺少过滤，提交包含恶意SQL命令的数据作为'id'参数，可修改'users'表，增加操作员相等权限的新用户。
solution:Upgrade leigh_business_enterprises web_helpdesk to a higher version than 1.2_1999-07-00,1.3_2000-07-00,1.4_2000-08-00,4.0.0.33_2001-05-00,4.0.0.35_2001-06-04,4.0.0.38_2001-06-10,4.0.0.40_2001-07-21,4.0.0.41_2001-08-27,4.0.0.43_2001-09-28,4.0.0.50,4.0.0.52,4.0.0.53,4.0.0.54,4.0.0.59,4.0.0.60,4.0.0.61,4.0.0.62,4.0.0.63,4.0.0.64,4.0.0.65,4.0.0.66,4.0.0.67,4.0.0.68,4.0.0.69,4.0.0.70,4.0.0.71,4.0.0.72,4.0.0.73,4.0.0.74,4.0.0.75,4.0.0.76,4.0.0.77,4.0.0.78,4.0.0.79,4.0.0.80,4.0_2001-03-00,and avoid the version 1.2_1999-07-00,1.3_2000-07-00,1.4_2000-08-00,4.0.0.33_2001-05-00,4.0.0.35_2001-06-04,4.0.0.38_2001-06-10,4.0.0.40_2001-07-21,4.0.0.41_2001-08-27,4.0.0.43_2001-09-28,4.0.0.50,4.0.0.52,4.0.0.53,4.0.0.54,4.0.0.59,4.0.0.60,4.0.0.61,4.0.0.62,4.0.0.63,4.0.0.64,4.0.0.65,4.0.0.66,4.0.0.67,4.0.0.68,4.0.0.69,4.0.0.70,4.0.0.71,4.0.0.72,4.0.0.73,4.0.0.74,4.0.0.75,4.0.0.76,4.0.0.77,4.0.0.78,4.0.0.79,4.0.0.80,4.0_2001-03-00