PT-2015-6045

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue concerns the use of a hardcoded password for the sa SQL Server Express user account. This hardcoded password, Password1, can be leveraged by remote authenticated users to bypass...

PT-2015-6037

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to create administrator accounts via a crafted request to "/createnewaccount" or write to arbitrary files via the fileName parameter to "/userentry"...

PT-2015-6039

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue is related to the RdsLogsEntry servlet, which does not properly check file extensions. This allows remote attackers to upload and execute arbitrary files by appending a NULL byte...

CVE-2015-2998: Exposure of Sensitive Information to an Unauthorized Actor

SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml...

CVE-2015-2999: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

CVE-2015-2994: Undefined Security Weakness

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...

CVE-2015-2993: Undefined Security Weakness

SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to 1 create administrator accounts via a crafted request to /createnewaccount or 2 write to arbitrary files via the fileName parameter to /userentry...

CVE-2015-3001: Undefined Security Weakness

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password...

CVE-2015-2995: Improper Limitation of a Pathname to a Restricted Directory

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file...

CVE-2015-2996: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the fileName parameter to getGfiUpgradeFile or 2 cause a denial of service CPU and memory consumption via a .. dot dot in the fileName parameter to...

CVE-2015-3000: Undefined Security Weakness

SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service CPU and memory consumption via a large number of nested entity references in an XML document to 1 /agententry, 2 /rdsmonitoringresponse, or 3 /androidactions, aka an XML Entity Expansion XEE attack...

PT-2015-6041

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to the getAgentLogFile endpoint. This can be achieved by providing a large...

PT-2015-6044

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to cause a denial of service, consuming CPU and memory, via a large number of nested entity references in an XML document to API endpoints such as...

PT-2015-6040

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to directory traversal vulnerabilities. This can be achieved by using a .. dot dot in the fileName...

[Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc)

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

PT-2015-6043

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved through various means, including the groupFilter parameter in an AssetDetails report to...

PT-2015-6038

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue concerns an unrestricted file upload vulnerability. This allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension to the icons/user photo/...

CVE-2015-2997: Exposure of Sensitive Information to an Unauthorized Actor

SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message...

SysAid Help Desk 14.4 Multiple Vulnerabilities

SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities. Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they...

SysAid Help Desk 14.4 Code Execution / Denial Of Service / Traversal / SQL Injection

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...