Unscored severity · published Jun 8, 2015
CVE-2015-3001
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access…
–
CVSS
6.8%
EPSS
No
On KEV
Description
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.8% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
Sysaid · Sysaid
through 15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3001
Exploit
http://packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
Exploit
http://seclists.org/fulldisclosure/2015/Jun/8
www.securityfocus.com
http://www.securityfocus.com/archive/1/535679/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/75035
Vendor Advisory
https://www.sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
More from Sysaid
9.8
CVE-2025-2776
SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity Injection
9.8
CVE-2023-47246
SysAid Server Path Traversal Vulnerability
7.5
CVE-2025-2775
SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity Injection
9.8
CVE-2025-2777
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator…
9.8
CVE-2024-36394
SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')