medium5.0Public exploit code
CVE-2015-2998
SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by de…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SysAid Help Desk 14.4 - Multiple Vulnerabilities2015-06-10 · webapps · hardware
Impact
SysAid Help Desk before 15.2 uses a hardcoded encryption key, which makes it easier for remote attackers to obtain sensitive information, as demonstrated by decrypting the database password in WEB-INF/conf/serverConf.xml.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sysaid | Sysaid | through 15.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jun/8
- http://www.securityfocus.com/archive/1/535679/100/0/threaded
- http://www.securityfocus.com/bid/75035
- https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
- http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
- http://seclists.org/fulldisclosure/2015/Jun/8
- http://www.securityfocus.com/archive/1/535679/100/0/threaded
- http://www.securityfocus.com/bid/75035
- https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk