Unscored severity · published Jun 8, 2015
CVE-2015-2999
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an…
–
CVSS
1.8%
EPSS
No
On KEV
Description
Multiple SQL injection vulnerabilities in SysAid Help Desk before 15.2 allow remote administrators to execute arbitrary SQL commands via the (1) groupFilter parameter in an AssetDetails report to /genericreport, customSQL parameter in a (2) TopAdministratorsByAverageTimer report or an (3) ActiveRequests report to /genericreport, (4) dir parameter to HelpDesk.jsp, or (5) grantSQL parameter to RFCGantt.jsp.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sysaid · Sysaid
through 15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2999
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2999
Exploit
http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2015/Jun/8
www.securityfocus.com
http://www.securityfocus.com/archive/1/535679/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/75038
Vendor Advisory
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
More from Sysaid
9.8
CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
9.8
CVE-2023-47246
SysAid Server Path Traversal Vulnerability
7.5
CVE-2025-2775
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
9.8
CVE-2025-2777
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator…
9.8
CVE-2024-36394
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')