CVE-2015-3001: Undefined Security Weakness

SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password...

CVE-2015-2995: Improper Limitation of a Pathname to a Restricted Directory

The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file...

PT-2015-6044

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to cause a denial of service, consuming CPU and memory, via a large number of nested entity references in an XML document to API endpoints such as...

PT-2015-6039

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue is related to the RdsLogsEntry servlet, which does not properly check file extensions. This allows remote attackers to upload and execute arbitrary files by appending a NULL byte...

[Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc)

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

CVE-2015-2996: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the fileName parameter to getGfiUpgradeFile or 2 cause a denial of service CPU and memory consumption via a .. dot dot in the fileName parameter to...

PT-2015-6042

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to obtain sensitive information due to the use of a hardcoded encryption key. This can be demonstrated by decrypting the database password in the...

PT-2015-6045

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue concerns the use of a hardcoded password for the sa SQL Server Express user account. This hardcoded password, Password1, can be leveraged by remote authenticated users to bypass...

PT-2015-6043

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved through various means, including the groupFilter parameter in an AssetDetails report to...

CVE-2015-2999: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

CVE-2015-2998: Exposure of Sensitive Information to an Unauthorized Actor

SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml...

CVE-2015-2997: Exposure of Sensitive Information to an Unauthorized Actor

SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message...

PT-2015-6041

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to the getAgentLogFile endpoint. This can be achieved by providing a large...

PT-2015-6040

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to read arbitrary files or cause a denial of service due to directory traversal vulnerabilities. This can be achieved by using a .. dot dot in the fileName...

PT-2015-6037

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote attackers to create administrator accounts via a crafted request to "/createnewaccount" or write to arbitrary files via the fileName parameter to "/userentry"...

PT-2015-6038

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue concerns an unrestricted file upload vulnerability. This allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension to the icons/user photo/...

SysAid Help Desk 14.4 Multiple Vulnerabilities

SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities. Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they...

SysAid Help Desk 14.4 Code Execution / Denial Of Service / Traversal / SQL Injection

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SysAid Help Desk Administrator Portal Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerabili...

SysAid Help Desk Administrator Account Creation

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to create an administrator account. Note that this exploit will only work once. Any subsequent attempts will fail. On the other hand, the credentials must be verified manually. This module has been tested...