CVE-2015-2993

SysAid Help Desk before 15.2 is affected by an access-control flaw that lets unauthenticated attackers (1) create administrator accounts via /createnewaccount and (2) write arbitrary files via the fileName parameter to /userentry. Public material confirms vulnerable versions and root cause as imp...

CVE-2015-2995

CVE-2015-2995 affects SysAid Help Desk prior to 15.2, in the RdsLogsEntry servlet, where improper file-extension checking allows remote upload and execution of arbitrary files via a NULL byte after the extension (e.g., .war%00). Connected sources confirm a concrete exploit surface, including a Me...

CVE-2015-2994

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...

CVE-2015-2996

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to 1 read arbitrary files via a .. dot dot in the fileName parameter to getGfiUpgradeFile or 2 cause a denial of service CPU and memory consumption via a .. dot dot in the fileName parameter to...

CVE-2015-3000

SysAid Help Desk before 15.2 allows remote attackers to cause a denial of service CPU and memory consumption via a large number of nested entity references in an XML document to 1 /agententry, 2 /rdsmonitoringresponse, or 3 /androidactions, aka an XML Entity Expansion XEE attack...

CVE-2015-2999

Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the 1 groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a 2 TopAdministratorsByAverageTimer report or an 3 ActiveRequest...

CVE-2015-2997

SysAid Help Desk (pre-15.2) vulnerability CVE-2015-2997: an information-disclosure path vulnerability via the accountId parameter in getAgentLogFile can reveal installation paths. The CVE is leveraged by combined directory-traversal flaws (CVE-2015-2996) to enable arbitrary file download, demonst...

CVE-2015-2996

CVE-2015-2996 affects SysAid Help Desk prior to 15.2. It involves directory traversal vulnerabilities that allow remote attackers to read arbitrary files via .. in the fileName parameter to getGfiUpgradeFile, and to cause a denial of service via .. in the fileName parameter to calculateRdsFileChe...

CVE-2015-2998

SysAid Help Desk (before version 15.2) is affected by CVE-2015-2998 due to a hardcoded encryption key used to encrypt sensitive data. The vulnerability allows remote attackers to obtain sensitive information by decrypting the database password stored in WEB-INF/conf/serverConf.xml, as demonstrate...

CVE-2015-2994

CVE-2015-2994 is an unrestricted file upload vulnerability in SysAid Help Desk’s ChangePhoto.jsp (before 15.2). An attacker with admin access can upload a .jsp and access it via icons/user_photo/, enabling arbitrary code execution on the server. Evidence of exploitation/poCs exists (Metasploit mo...

[Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc)

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

SysAid Help Desk 14.4 Multiple Vulnerabilities

SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities. Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they...

SysAid Help Desk Arbitrary File Download

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. First, an information disclosure vulnerability CVE-2015-2997 is used to obtain the file system path, and then we abuse a directory traversal CVE-2015-2996 ...

SysAid Help Desk Database Credentials Disclosure

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. This is used to download the server configuration file that contains the database username and password, which is encrypted with a fixed, known key. This modul...

SysAid Help Desk Administrator Portal Arbitrary File Upload

This module exploits a file upload vulnerability in SysAid Help Desk. The vulnerability exists in the ChangePhoto.jsp in the administrator portal, which does not correctly handle directory traversal sequences and does not enforce file extension restrictions. While an attacker needs an administrat...

SysAid Help Desk Administrator Account Creation

This module exploits a vulnerability in SysAid Help Desk that allows an unauthenticated user to create an administrator account. Note that this exploit will only work once. Any subsequent attempts will fail. On the other hand, the credentials must be verified manually. This module has been tested...

SysAid Help Desk 14.4 Code Execution / Denial Of Service / Traversal / SQL Injection

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...

SysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'SysAid Help Desk Administrator Portal Arbitrary File Upload', 'Description' = %q This module exploits a file upload vulnerabili...

IBM Eclipse Help System (IEHS) Cross-Site Scripting Vulnerability

Exploit for windows platform in category remote exploits IBM Eclipse Help System IEHS Cross-Site Scripting Vulnerability + Author: Filippo Roncari + Target: IBM Eclipse Help System IEHS + Version: 6.1.0 = 6.1.0.6, 6.1.5 = 6.1.5.3, 7.0 = 7.0.0.2, 8.0 8.0.0.1 + Vendor: http://www.ibm.com +...

IBM Eclipse Help System (IEHS) Cross Site Scripting

IBM Eclipse Help System IEHS Cross-Site Scripting Vulnerability + Author: Filippo Roncari + Target: IBM Eclipse Help System IEHS + Version: 6.1.0 = 6.1.0.6, 6.1.5 = 6.1.5.3, 7.0 = 7.0.0.2, 8.0 8.0.0.1 + Vendor: http://www.ibm.com + Accessibility: Remote + Severity: Medium + CVE: CVE-2014-0917 +...