CVE-2015-2999: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

PT-2015-6043

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved through various means, including the groupFilter parameter in an AssetDetails report to...