CVE-2015-2995
SysAid < 15.1 - Remote Code Execution via RdsLogsEntry File Upload
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2015-2995.
PoCs published by Metasploit, including Metasploit module exploits/multi/http/sysaid_rdslogs_file_upload.
AI-analyzed exploit summary This Metasploit module exploits an arbitrary file upload vulnerability in SysAid Help Desk by leveraging insecure handling of zip file contents in the RdsLogsEntry servlet, leading to remote code execution via WAR file deployment.
Description
The RdsLogsEntry servlet in SysAid Help Desk before 15.2 does not properly check file extensions, which allows remote attackers to upload and execute arbitrary files via a NULL byte after the extension, as demonstrated by a .war%00 file.
Exploits (3)
This Metasploit module exploits an arbitrary file upload vulnerability in SysAid Help Desk by leveraging insecure handling of zip file contents in the RdsLogsEntry servlet, leading to remote code execution via WAR file deployment.
This is a detailed technical writeup describing multiple vulnerabilities in SysAid Help Desk 14.4, including administrator account creation, file upload via directory traversal, arbitrary file download, path disclosure, hard-coded cryptographic key usage, and SQL injection. The writeup provides specific technical details, such as affected endpoints, payload formats, and constraints for each vulnerability.
This Metasploit module exploits an unauthenticated file upload vulnerability in SysAid Help Desk v14.3 and v14.4 via the RdsLogsEntry servlet, leveraging insecure handling of zip file contents and null byte injection to achieve remote code execution.