Vulnerability record · CVE-2015-2994 · published 8 June 2015
CVE-2015-2994: SysAid Help Desk unrestricted file upload in ChangePhoto.jsp enables code execution
Sysaid · Sysaid
ChangePhoto.jsp in SysAid Help Desk before 15.2 permits uploading files with a .jsp extension without restricting file type. Because uploaded files are stored under icons/user_photo/ and can be requested directly, an attacker with administrator access can place executable JSP content on the server. This turns a routine photo upload feature into a remote code execution path.
Description
Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.
AV:N/AC:L/Au:S/C:P/I:P/A:P
Automated analysis
high priorityThe flaw yields remote code execution, public exploit code is available, and EPSS is very high, though exploitation requires an authenticated administrator account.
What it is
ChangePhoto.jsp in SysAid Help Desk before 15.2 permits uploading files with a .jsp extension without restricting file type. Because uploaded files are stored under icons/user_photo/ and can be requested directly, an attacker with administrator access can place executable JSP content on the server. This turns a routine photo upload feature into a remote code execution path.
Impact
An attacker gains arbitrary code execution with the privileges of the SysAid web application, allowing full compromise of the help desk server and any data it can reach. The CVSS v2 vector rates confidentiality, integrity and availability impact as partial.
Attack surface
Reachable over the network through the ChangePhoto.jsp upload endpoint; the CVSS vector (AV:N/AC:L/Au:S) indicates low complexity but requires an authenticated account with administrator privileges. No user interaction is needed beyond the attacker's own upload and subsequent direct request to the stored file.
Exploitation
Public exploit references exist (Packet Storm and Full Disclosure entries tagged Exploit), and EPSS is high at 0.498 (98.8th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.
What to do
- Upgrade SysAid Help Desk to version 15.2 or later, which the vendor advisory indicates addresses this issue.
- If immediate upgrade is not possible, restrict or disable the ChangePhoto.jsp upload function and block direct HTTP access to the icons/user_photo/ directory.
- Enforce server-side file type validation and store uploaded files outside the web root with non-executable permissions.
- Limit administrator accounts to the minimum necessary and audit them for unexpected additions.
- Place the SysAid web application behind a reverse proxy or WAF rule that rejects .jsp uploads and direct requests to uploaded file paths.
Detection
- Monitor web server and SysAid logs for POST requests to ChangePhoto.jsp followed by GET requests to files under icons/user_photo/ with .jsp extensions.
- Alert on creation of .jsp files in the icons/user_photo/ directory or any upload directory.
- Review administrator account activity for unexpected photo uploads or logins from unusual source addresses.
- Search file system for JSP files in upload or icon directories that do not match expected image content.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-2994 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-2994), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
