CVE-2015-2993
HighSummary
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, allowing remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
Risk Assessment
An attacker can gain unauthorized access to administrator accounts and modify files on the server, potentially leading to serious security breaches for the organization.
Recommendation
It is recommended to upgrade SysAid Help Desk to version 15.2 or later to eliminate these vulnerabilities and implement additional access control measures.
Other vulnerabilities in SysAid Help Desk
See all- CVE-2015-3000High
SysAid Help Desk versions before 15.2 are vulnerable to an XML Entity Expansion (XEE) attack, allowing remote attackers to cause denial of service through a large number of nested entity references in an XML document.
- CVE-2015-2996High
Multiple directory traversal vulnerabilities in SysAid Help Desk before version 15.2 allow remote attackers to read arbitrary files and cause denial of service.
Original NVD description (English source)
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.