CVE-2015-2996

NUCLEI

SysAid Help Desk Arbitrary File Download

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2015-2996. Includes Metasploit module auxiliary/admin/http/sysaid_file_download. A Nuclei detection template is also available.

AI-analyzed exploit summary This document provides a detailed technical analysis of multiple vulnerabilities in SysAid Help Desk 14.4, including administrator account creation, file upload via directory traversal, arbitrary file download, path disclosure, hard-coded cryptographic key usage, and SQL injection. It includes proof-of-concept requests and Metasploit module references.

Description

Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.

Exploits (3)

exploitdb WRITEUP
webappshardware
https://www.exploit-db.com/exploits/43885

This document provides a detailed technical analysis of multiple vulnerabilities in SysAid Help Desk 14.4, including administrator account creation, file upload via directory traversal, arbitrary file download, path disclosure, hard-coded cryptographic key usage, and SQL injection. It includes proof-of-concept requests and Metasploit module references.

Classification
Writeup 100%
Attack Type
Info Leak | Auth Bypass | Rce | Sqli
Complexity
Moderate
Reliability
Reliable
Target: SysAid Help Desk 14.4
No auth needed
Prerequisites: Network access to the target system · For some vulnerabilities, an administrator account is required
devstral-2 · analyzed Feb 19, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/sysaid_file_download.rb

This Metasploit module exploits CVE-2015-2996 (directory traversal) and CVE-2015-2997 (info disclosure) in SysAid Help Desk to download arbitrary files. It first determines the traversal path via an error message, then uses it to fetch the target file.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: SysAid Help Desk 14.4
No auth needed
Prerequisites: Network access to the target · SysAid Help Desk running on port 8080
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/sysaid_sql_creds.rb

This Metasploit module exploits an arbitrary file download vulnerability in SysAid Help Desk to retrieve the server configuration file containing encrypted database credentials. It then decrypts the credentials using a known fixed key and reports them.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: SysAid Help Desk 14.4
No auth needed
Prerequisites: Network access to the target SysAid Help Desk instance
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

SysAid Help Desk <15.2 - Local File Inclusion
HIGHby 0x_Akoko
Shodan: http.favicon.hash:1540720428
FOFA: icon_hash=1540720428

References (5)

Core 5
Core References
Exploit mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2015/Jun/8
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/535679/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75038

Scores

EPSS 0.8823
EPSS Percentile 99.5%

Details

CWE
CWE-22
Status published
Products (1)
sysaid/sysaid < 15.1
Published Jun 08, 2015
Tracked Since Feb 18, 2026