PT-2015-6038 · Sysaid · Sysaid Help Desk

Pedro Ribeiro · Published 2015-06-08 · Updated 2018-10-09 · CVE-2015-2994

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SysAid Help Desk versions prior to 15.2

Description The issue concerns an unrestricted file upload vulnerability. This allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension to the icons/user photo/ directory, and then accessing it via a direct request.

Recommendations For versions prior to 15.2, update to version 15.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the ChangePhoto.jsp file and limiting the types of files that can be uploaded to prevent exploitation.

Exploit

Fix

Related Identifiers

CVE-2015-2994

Affected Products

Sysaid Help Desk

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/sysaid_auth_file_upload.rb · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/Jun/8 · Exploit
• 🔥 https://exploit-db.com/exploits/43885 · Exploit
• 🔥 http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/41691 · Exploit
• https://sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2994 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2994 · Note
• http://securityfocus.com/archive/1/535679/100/0/threaded · Note
• http://securityfocus.com/bid/75038 · Note