Published: 08/06/2015 Updated: 09/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 585

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

SysAid Help Desk prior to 15.2 allows remote malicious users to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sysaid sysaid

>> Multiple vulnerabilities in SysAid Help Desk 144 >> Discovered by Pedro Ribeiro (pedrib@gmailcom), Agile Information Security ================================================================================= Disclosure: 03/06/2015 / Last updated: 10/06/2015 >> Background on the affected product: "SysAid is an ITSM solution t ...

SysAid Help Desk version 144 suffers from code execution, denial of service, path disclosure, remote file upload, remote SQL injection, directory traversal, file download, and various other vulnerabilities ...

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system First, an information disclosure vulnerability (CVE-2015-2997) is used to obtain the file system path, and then we abuse a directory traversal (CVE-2015-2996) to download ...

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. First, an information disclosure vulnerability (CVE-2015-2997) is used to obtain the file system path, and then we abuse a directory traversal (CVE-2015-2996) to download the file. Note that there are some limitations on Windows, in that the information disclosure vulnerability doesn't work on a Windows platform, and we can only traverse the current drive (if you enter C:\afile.txt and the server is running on D:\ the file will not be downloaded). This module has been tested with SysAid 14.4 on Windows and Linux.

msf > use auxiliary/admin/http/sysaid_file_download
msf auxiliary(sysaid_file_download) > show actions
    ...actions...
msf auxiliary(sysaid_file_download) > set ACTION < action-name >
msf auxiliary(sysaid_file_download) > show options
    ...show and set options...
msf auxiliary(sysaid_file_download) > run

This module exploits two vulnerabilities in SysAid Help Desk that allows an unauthenticated user to download arbitrary files from the system. First, an information disclosure vulnerability (CVE-2015-2997) is used to obtain the file system path, and then we abuse a directory traversal (CVE-2015-2996) to download the file. Note that there are some limitations on Windows, in that the information disclosure vulnerability doesn't work on a Windows platform, and we can only traverse the current drive (if you enter C:\afile.txt and the server is running on D:\ the file will not be downloaded). This module has been tested with SysAid 14.4 on Windows and Linux.

msf > use auxiliary/admin/http/sysaid_file_download
msf auxiliary(sysaid_file_download) > show actions
    ...actions...
msf auxiliary(sysaid_file_download) > set ACTION < action-name >
msf auxiliary(sysaid_file_download) > show options
    ...show and set options...
msf auxiliary(sysaid_file_download) > run

CWE-200 https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk http://seclists.org/fulldisclosure/2015/Jun/8 http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html http://www.securityfocus.com/bid/75038 http://www.securityfocus.com/archive/1/535679/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/43885/https://www.rapid7.com/db/modules/auxiliary/admin/http/sysaid_file_download

CVE-2015-2997

Vulnerability Summary

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect