CVE-2015-2994
SysAid < 15.1 - Unauthenticated Arbitrary File Upload and Remote Code Execution via ChangePhoto.jsp
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-2994.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/sysaid_auth_file_upload.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in SysAid Help Desk's ChangePhoto.jsp, allowing authenticated attackers to upload a malicious JSP file for remote code execution. It supports both Linux and Windows targets and includes automatic target detection.
Description
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in SysAid Help Desk's ChangePhoto.jsp, allowing authenticated attackers to upload a malicious JSP file for remote code execution. It supports both Linux and Windows targets and includes automatic target detection.
This is a detailed technical writeup describing multiple vulnerabilities in SysAid Help Desk 14.4, including administrator account creation, file upload via directory traversal, arbitrary file download, path disclosure, hard-coded cryptographic key usage, and SQL injection. The writeup provides specific technical details, such as affected endpoints, payloads, and constraints for each vulnerability.
This Metasploit module exploits a file upload vulnerability in SysAid Help Desk's ChangePhoto.jsp, allowing arbitrary file upload via directory traversal and weak file extension handling. It requires administrator credentials and has been tested on SysAid v14.4 for both Linux and Windows.