CVE-2015-2999
SysAid Help Desk 14.4 - Multiple Vulnerabilities
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a (2) TopAdministratorsByAverageTimer report or an (3) ActiveRequests report to /genericreport, (4) dir parameter to HelpDesk.jsp, or (5) grantSQL parameter to RFCGantt.jsp.
Múltiples vulnerabilidades de inyección SQL en SysAid Help Desk anterior a 15.2 permiten a administradores remotos ejecutar comandos SQL arbitrarios a través (1) del parámetro groupFilter en un informe AssetDetails en /genericreport, del parámetro customSQL en (2) un informe TopAdministratorsByAverageTimer o (3) un informe ActiveRequests en /genericreport, (4) del parámetro dir en HelpDesk.jsp, o (5) del parámetro grantSQL en RFCGantt.jsp.
SysAid Help Desk version 14.4 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-04-07 CVE Reserved
- 2015-06-03 CVE Published
- 2015-06-10 First Exploit
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/archive/1/535679/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/75038 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk | 2018-10-09 |