CVE-2015-2996

This document provides a detailed technical analysis of multiple vulnerabilities in SysAid Help Desk 14.4, including administrator account creation, file upload via directory traversal, arbitrary file download, path disclosure, hard-coded cryptographic key usage, and SQL injection. It includes proof-of-concept requests and Metasploit module references.

This Metasploit module exploits CVE-2015-2996 (directory traversal) and CVE-2015-2997 (info disclosure) in SysAid Help Desk to download arbitrary files. It first determines the traversal path via an error message, then uses it to fetch the target file.

This Metasploit module exploits an arbitrary file download vulnerability in SysAid Help Desk to retrieve the server configuration file containing encrypted database credentials. It then decrypts the credentials using a known fixed key and reports them.