CVE-2015-2994

CVE Database · CVE-2015-2994

CVE-2015-2994

· N/AModified

CVSS v3.1

N/A

EPSS

49.79%

Published

Jun 8, 2015

Modified

May 6, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBSysAid Help Desk 14.4 - Multiple Vulnerabilities Exploit-DBSysAid Help Desk Administrator Portal < 14.4 - Arbitrary File Upload (Metasploit)TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.

Affected Products (1)

sysaid · sysaidvulnerable

References (10)

http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html

Exploit

http://seclists.org/fulldisclosure/2015/Jun/8

Exploit

http://www.securityfocus.com/archive/1/535679/100/0/threaded

http://www.securityfocus.com/bid/75038

https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk

Vendor Advisory

http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html

Exploit

http://seclists.org/fulldisclosure/2015/Jun/8

Exploit

KEV Catalog EPSS Scores Vendors All CVEs