SysAid Help Desk 14.4 Multiple Vulnerabilities

SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities. Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they...

SysAid Help Desk 14.4 Code Execution / Denial Of Service / Traversal / SQL Injection

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at 1. 5 Metasploit modules have been released and currently awaiting merge in the moderati...