Vulnerability record · CVE-2015-2993 · published 8 June 2015
CVE-2015-2993: SysAid Help Desk access control flaw allows admin creation and arbitrary file write
Sysaid · Sysaid
SysAid Help Desk before 15.2 fails to properly restrict access to certain functionality. A remote, unauthenticated attacker can create administrator accounts via a crafted request to /createnewaccount or write to arbitrary files via the fileName parameter to /userentry. This is a pre-authentication access control failure in an internet-facing help desk product, so it matters for any unpatched instance.
Description
SysAid Help Desk before 15.2 does not properly restrict access to certain functionality, which allows remote attackers to (1) create administrator accounts via a crafted request to /createnewaccount or (2) write to arbitrary files via the fileName parameter to /userentry.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityPre-authentication remote access control bypass with public exploit code and very high EPSS, though not confirmed in KEV.
What it is
SysAid Help Desk before 15.2 fails to properly restrict access to certain functionality. A remote, unauthenticated attacker can create administrator accounts via a crafted request to /createnewaccount or write to arbitrary files via the fileName parameter to /userentry. This is a pre-authentication access control failure in an internet-facing help desk product, so it matters for any unpatched instance.
Impact
An attacker gains administrative control of the help desk by creating their own admin account, and can write arbitrary files on the server, which can lead to code execution or full system compromise.
Attack surface
Reachable over the network via HTTP requests to /createnewaccount and /userentry. The CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Public exploit references exist (Packet Storm and Full Disclosure entries tagged Exploit), and EPSS is 0.55362 (99th percentile), indicating elevated likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.
What to do
- Upgrade SysAid Help Desk to version 15.2 or later, which the vendor advisory identifies as the fixed release.
- If immediate patching is not possible, restrict network access to the SysAid web interface to trusted networks or place it behind an authenticated reverse proxy.
- Block or monitor direct external requests to /createnewaccount and /userentry at the web tier.
- Audit existing SysAid administrator accounts and remove any that are unrecognized.
- Review file system write permissions for the SysAid service account and restrict writes to required directories only.
Detection
- Monitor web logs for POST or GET requests to /createnewaccount and /userentry, especially from external or unexpected source IPs.
- Alert on creation of new SysAid administrator accounts, particularly outside change windows.
- Watch for unexpected file creation or modification in SysAid web-accessible directories.
- Correlate SysAid access logs with file integrity monitoring on the SysAid host.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-2993 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2993), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
